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for  the  design  of  alerting  system  displays  for  future  commercial  transport 
aircraft.  The  present  effort  addresses  the  question  whether  the  alerting 
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1.0  INTRODUCTION 


1.1  PROGRAM  HISTORY 

This  study  of  aircraft  alerting  systems  and  ad'  need  flight,  status  monitor  con¬ 
cepts  was  initiated  in  1973  when  the  Federal  Aviation  Administration  ( FAA) 
contracted  Boeing  to  study  concepts  for  independent  altitude  monitors.  One  of 
the  goals  of  this  effort  was  to  identify  a  unique  alertinq  method  for  an 
independent  altitude  monitior  (Ref.  1).  A  follow-up  study,  conducted  in 
1974-1975,  investigated  operational  philosophies  for  implementing  effective 
and  reliable  alerting  systems.  The  study  provided  a  summary  of  alert 
philosophies  and  alerting  characteristics  used  in  then-current  aircraft 
(Ref.  2).  In  1976  the  FAA  extended  the  study  to  investigate  alerting  methods 
used  in  the  design  of  commercial  transports.  The  results  of  that  study 
provided  basic  concepts  for  design  objectives  and  guidelines  for  alerting 
systems  for  future  aircraft  (Ref.  3).  Table  1-1  shows  the  objectives  of 
this,  and  the  earlier  studies. 

The  major  findings  of  the  1976  study  were  as  follows: 

o  There  had  been  a  significant  increase  in  the  number  of  alertinq  signals 
used  on  new  conmercial  transports.  For  example,  in  going  from  the  707  to 
the  747,  the  number  of  alerting  signals  increased  from  IRft  to  455,  or  142 
percent.  The  increase  from  the  DC-B  to  the  DC-10  was  from  172  to  41fl,  or 
143  percent. 

o  Very  little  standardization  had  been  used  by  the  airframe  manufacturers 
in  implementing  alerting  system  elements.  Not  only  were  there  vast  dif¬ 
ferences  between  airframe  manufacturers,  but  individual  manufacturers 
were  inconsistent  in  the  application  of  alertinq  signals  within  their 
airplanes. 
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Table  1-1.  Previous  Alerting  System  Studies— Contract  DOT-FA 73WA-3233 


Title 

(Report  -) 

Development  of  an 
independent  altitude 
monitor  concept 
(FAA  RD  73-168) 

Independent  altitude 
monitor  alert  methods 
and  modes  study 
(FAA-RD-75-86) 

Collation  and  analysis 
of  aircraft  alerting 
systems  data 
(FAA-RD  76-222) 

Objectives 

e  Identify  nature  of  typical 
inadvertent  terrain  impact 
accident  scenarios 

e  Identify  techniques  whereby 
inadvertent  terrain  impact 
accidents  might  be  reduced 

e  Identify  functional  elements 
of  an  independent  altitude 
monitor  concept 

e  Identify  methods  of 
implementing  independent 
monitor  systems 

a  Develop  operational  alert 
philosophy  and  concepts 

•  Demonstrate  and  refine 
selected  independent 
altitude  monitor  alerting 
methods 

•  Oevelop  independent 
altitude  monitor 
implementation  plan 

•  Tabulate  current  alerting  methods 
and  requirements  for  all  cockpit 
alerting  functions 

•  Develop  method  for  prioritizing 
alerting  functions 

•  Prioritize  alerting  functions 

•  Correlate  requirements  with 
prioritized  functions  and  note 
conflicts 

•  Broaden  stimuli  response  data  base 

•  Define  tests  for  acquiring  stimuli 
response  data  not  available  in 
literature  but  required  for 
designing  alerting  systems 

•  Provide  recommendations  for 
standardization  of  alerting 
functions  and  methods 

Period 

February  1973  to 
September  1973 

June  1974  to  July  1975 

January  1976  to  Way  1977 
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For  these  two  reasons,  proliferation  of  alerts  and  the  lack  of  standardiza¬ 
tion,  airline  pilots  were  beginning  to  view  alerting  systems  as  a  nuisance 
rather  than  a  help.  It  was  reported  in  1977  that  "Caution  and  warninq  systems 
were  originally  installed  as  a  reasonable  means  of  assistinq  pilots  to 
maintain  safe,  reliable,  and  economical  system  operation  in  the  face  of  hiqh 
workloads.  However,  these  systems,  intended  to  reduce  hazards,  are  themselves 
becoming  hazards.  The  vast  increase  in  the  numbers  of  alerts  and  the  frequent 
occurrence  of  false  or  nuisance  alerts  impose  heavy  demands  on  the  aircrew. 
More  alerts  require  more  memorization,  higher  workloads  and  could  induce  a 
higher  probability  of  error"  (Ref.  4). 

The  identification  of  these  problems  in  current  day  alerting  systems  led  to 
the  present  study,  conducted  under  contract  D0T-FA79WA-4268.  Table  1-2  sum¬ 
marizes  the  major  objectives  of  the  present  study  contract,  the  qoal  of  which 
is  to  develop  design  guidelines  for  improving  and  standardizing  future 
aircraft  alerting  systems.  To  promote  this  standardization,  the  work  was 
performed  as  a  joint  effort  between  the  three  major  U.S.  commercial  aircraft 
manufacturing  companies  with  Boeing  as  prime  contractor  and  Lockheed  and 
Douglas  Aircraft  as  subcontractors. 

1.2  PRESENT  STUDY 

During  the  course  of  the  present  study,  interest  was  developed  within  the  FAA 
in  expanding  the  requirements  of  the  alerting  system  defined  in  the  previous 
studies  to  include  flight  monitoring.  Past  efforts  had  been  concerned  with 
those  system  functions  and  components  which  are  directly  involved  in  alerting 
the  aircrew  of  abnormal  conditions  or  situations.  The  focus  was  on  how  to 
best  display  a  given  alert,  given  its  urgency  level.  Several  assumptions  were 
made  in  developing  the  alerting  system  guidelines: 

o  An  event  had  occurred 

o  A  fault  had  been  identified 

o  The  urgency  of  the  alert,  had  been  established 
o  The  flight  crew  has  to  be  alerted. 
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Table  1-2.  Aircraft  Alerting  Systems  Standardization  Study— Contract  D0T-FA79WA-4268 


TITLE 

(Report  *) 

Phase  l 

Define  prototype  alerting 
system  concepts 
(FAA  RD-80-68) 

Phase  II 

Plan  tests  lor  proto¬ 
type  alerting  system 
concept  evaluations 

Phase  III 

Evaluate  prototype 
alerting  syttem  concepts 
(FAA-RD-81  38  1  &  II) 

OBJECTIVES 

•  Acquire  miasma  stimuli 

•  Select  simulation 

•  Develop  brattboard 

response  data  via  appro- 

facility 

hardware  for  selected 

priate  simulator  tests 

a  Develop  test  plan 

alerting  system  concepts 

•  Define  alerting  system 

•  Coordinate  test  plan 

•  Perform  comparative 

concepts 

•  Assess  physical  character¬ 
istics  of  each  concept 

•  Assets  implementation 
feasibility  of  each  concept 

with  FAA 

simulator  evaluation  of 
selected  concepts 

•  Finalise  design  guide¬ 
lines  for  standardized 
alerting  system 

•  Select  alerting  system 
concepts  for  comparative 
evaluation 


•  Assess  certification  impact 


The  Aircraft  Alerting  Systems  Design  Guidelines  developed  in  Phase  III  of  this 
study,  (Ref.  5)  will  foster  uniformity  in  alert  presentation  amonq  different 
aircraft  types.  However,  much  more  than  alerting  systems  components  (e.q., 
tones,  master  warning  and  caution  lights,  voice  messages,  etc.)  will  be 
required  to  perform  the  flight  status  monitor  function.  The  primary  differ¬ 
ences  between  an  alerting  system  and  a  flight,  status  monitor  system  are: 

o  A  flight  status  monitor  system  could  alert  the  crew  to  operational  as 

well  as  mechanical  abnormal  conditions,  and  could  also  inform  the  crew  of 
the  proper  corrective  action. 


o  A  flight  status  monitor  system  would  be  computer-based  and  be  programmed 
to  prioritize  and/or  inhibit  alerts  during  critical  flight  phases  and 
during  multiple  failure  conditions. 

o  Being  computer-based  and  linked  to  other  cockpit  systems,  the  fliqht 
status  monitor  could  provide  crew  alerting  for  a  wider  range  of 
functions,  including  flight  operations. 

o  Being  computer-based,  the  flight  status  monitor  could  use  stored 

information  acquired  from  maintenance  experts  and  sensor  data  to  perform 
trend  analysis  and  provide  the  crew  with  indications  of  system 
degradation  and  failure  prior  to  detection  by  primary  alert  sensors. 


To  transform  an  alerting  system  into  a  flight,  status  monitor,  the  following 
component  functions  are  needed: 

o  sensing  to  provide  source  information; 

o  interfacing  to  other  aircraft  systems  for  data  transfer; 

o  computing  and  processing  to  assimilate  and  process  status  informa- 
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tion  using  predefined  algorithms  and  to  decide  what  alerts  need  to 
be  displayed  and  when; 

o  displaying  checklists  and  other  data  to  aid  the  crew  in  responding 
to  abnormal  conditions; 

o  providing  controls  to  enable  the  crew  to  interact  with  the  expanded 
system. 

The  alerting  system  defined  in  Phase  III  of  the  present  contract  would  only 
provide  the  alerting  function  of  a  flight  status  monitor  system.  A  Phase  IV 
effort  was  therefore  initiated  to  assess  the  feasibility  of  and  to  identify 
some  of  the  functional  requirements  for  a  flight  status  monitor  system. 

This  study,  entitled  "Accident  Implications  on  System  Design,"  was  conducted 
as  three  related  tasks: 

1.  Examination  and  analysis  of  aircraft  accident  and  incident  data  to 
identify  the  factors  that  have  contributed  to  aircraft  accidents  or 
incidents; 

2.  Examination  of  the  cockpit  environment; 

3.  Development  of  expanded  concepts  for  alerting  systems  to  monitor 
flight  status  and  enhance  crew  response  to  abnormal  conditions. 

This  report  desribes  the  activities  that  were  conducted  to  accomplish  these 
three  tasks  and  summarizes  the  major  findings. 
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While  t.he  study  assesses  the  role  of  the  alertinq  system  in  monitoring 
aircraft  system  status  and  operational  activities,  it  has  not  considered  the 
alerting  system  as  a  piece  of  hardware.  As  with  desiqn  guidelines  recently 
published,  only  the  functional  requirements  for  a  flight  status  monitor  were 
considered.  Sensors  were  considered  as  a  sensing  function,  and  computers  and 
processors  were  considered  only  for  their  computational  function.  Distributed 
versus  centralized  computer  designs  were  discussed  but  not  made  a  part  of 
recommended  functional  requi rements . 

1.3  REPORT  ORGANIZATION 

Section  2  of  this  report  is  an  Executive  Summary  of  the  major  activities  and 
findings  of  the  Phase  IV  effort.  The  objectives,  procedures  and  results  of 
Tasks  One  and  Two  are  contained  in  Sections  3  and  4,  respectively.  Conclu¬ 
sions  and  their  implications  on  the  concept  of  a  flight  status  monitor  system 
are  contained  in  Sections  5  and  6.  Section  7  describes  additional  functional 
requirements  for  the  design  of  a  flight  status  monitor  system.  Considerations 
for  implementation  of  such  a  system  are  contained  in  Section  ft.  Recommended 
future  activities,  including  a  flight  test  program  are  described  in  Section  9. 
The  forms  used  to  collect  data  for  Tasks  One  and  Two  are  contained  in  the 
Appendices . 


2.0  EXECUTIVE  SUMMARY 
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2.1  PROGRAM  BACKGROUND 

This  study,  the  fourth  in  a  series  havinq  evolved  from  a  study  of  independent 
altitude  monitor  requirements  and  alertinq  system  criteria,  has  developed  a 
set  of  guidelines  for  the  design  of  aircraft  alertinq  systems. 

During  the  conduct  of  the  study,  questions  were  raised  as  to  how  an  alertinq 
system  could  further  aid  the  crew  besides  simply  displaying  alerts  for  system 
failures  that  occur.  Recent  aircraft  accidents  raised  questions  as  to  whether 
the  aircraft  alerting  system  could  function  as  a  monitor  of  flight  safety, 
i.e.,  a  system  that  could  aid  the  crew  in  resolving  problems  and  perhaps 
reduce  future  accidents.  Figure  2-1  depicts  the  flight  status  monitor 
concept. 


SENSE  MONITOR  ALERT 


Figure  2 •  1.  Flight  Status  Monitor  Concept 
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These  questions  led  to  the  extension  of  the  alerting  system  study  contract  to 
include  Phase  IV,  which  was  titled,  "Accident  Implications  on  System  Design." 

2.2  CURRENT  PROGRAM 


Phase  IV  consisted  of  three  related  tasks:  analysis  of  aircraft  accident  and 
incident  data,  examination  of  the  cockpit  environment,  and,  based  on  the 
results  of  the  first  two,  development  of  expanded  alerting  system  desiqn 
concepts. 

2.2.1  l  TASK  ONE -EXAM (NATION  AND  ANALYSIS  OF  AIRCRAFT  ACCIDENT  AND 

INCIDENT  DATA 

2.2.1 .1  OBJECTIVES  AND  PROCEDURES 

This  task  consisted  of  examining  and  analyzing  data  from  recent  aircraft  acci¬ 
dents  and  incidents.  An  objective  of  the  review  was  to  determine  whether  any 
dominant  cause(s)  existed  in  the  accidents  and  incidents,  and  to  establish 
relationships  between  the  causal  factors  and  the  alertinq  system.  The  ultimate 
objective  was  to  provide  relevant  situations  or  failures  for  analysis  in  the 
development  of  concepts  in  Task  Three. 

Under  Task  One,  the  study  team  reviewed  National  Transportation  Safety  Board 
(NTSB)  reports  of  U.  S.  air  carrier  accidents,  reports  from  the  Aviation 
Safety  Reporting  System  (ASRS),  foreign  government  reports,  International 
Civil  Aviation  Organization  (ICAO)  reports,  and  company  in-house  sources. 

Two  data  bases  were  developed.  A  total  of  160  accidents  and  incidents  from 
sources  other  than  ASRS  were  reviewed.  A  total  of  163  ASRS  reports  were 
reviewed,  but  because  of  the  significant  differences  between  the  data  recorded 
in  the  ASRS  reports  and  the  NTSB-type  reports,  the  data  were  kept  separate. 

One  data  base  was  formed  from  the  ASRS  data,  and  the  other  came  from  the 
NTSB-type  reports.  For  the  remainder  of  this  report  the  term  NTSB  will  refer 
to  all  data  sources  except  the  ASRS. 
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2.2 2  TASK  TWO-EXAMINATION  OF  THE  COCKPIT  ENVIRONMENT 


222.1  OBJECTIVES  AND  PROCEDURES 

This  task  consisted  of  examining  the  cockpit  environment  by  riding  on 
commercial  transport  flights  to  observe  flight  deck  operations,  procedures, 
and  crew  member  activities.  An  objective  of  this  task  was  to  evaluate  the 
operational  environment  (the  flight  deck)  in  which  the  emergencies  occur.  The 
investigation  included  the  observation  of: 

o  frequency  of  occurrence  of  alerts 
o  crewmember  response(s)  to  alerts 
o  alerting  system  operation 
o  flight  deck  operations  and  activity 
o  crew  member  responsibilities  and  activity 
o  crew  member  survey  of  alertinq  system  needs. 

A  total  of  5?  flights  were  flown.  A  diversity  of  experience  was  obtained, 
including  day/night  flights  nf  long/short  duration  in  various  types  of 
aircraft  operated  by  various  airlines. 

2.3  CONCLUSIONS  FROM  TASKS  ONE  AND  TWO 

23.1  EXAMINATION  OF  ACCIDENT  DATA  (TASK  ONE) 

23.1.1  NTSB  DATA  BASE  LIMITATIONS 

The  NTSB  accident  histories  reviewed  in  the  study  included  a  high  proportion 
of  crew-caused  accidents.  For  the  purposes  of  the  study  it  was  desired  to 
review  a  large  number  of  crew-caused  accidents.  Previous  studies  have  shown 
that  a  majority  of  hull -loss  accidents  are  determined  to  be  caused  by  crew 
error  (Ref.  6).  Therefore,  of  the  160  accidents/incidents  examined,  99  were 
hull-loss  accidents,  20  resulted  in  substantial  damage,  27  resulted  in  minor 
damage,  and  only  14  resulted  in  no  damage  to  the  aircraft. 


The  data  from  the  present  accident  review  also  showed  a  correlation  between 
loss  of  aircraft  and  crew  causal  factor.  Of  the  43  accidents  for  which  only 
one  cause  was  apparent,  twenty-one  were  labeled  as  crew  error.  It  was 
noteworthy  that  every  crew-caused  accident  was  a  hull -loss  accident.  Equally 
important,  however,  is  that  when  the  flight  crew  is  lost  with  the  aircraft, 
little  data  is  available  to  evaluate  the  performance  of  the  crew  or  the 
alerting  system. 

2.3.12  ASRS  DATA  BASE  LIMITATIONS 

ASRS  reports  are  submitted  voluntarily  by  participants  in  the  aviation 
community.  After  preliminary  processing,  all  ASRS  reports  are  written  so  that 
there  is  no  way  to  identify  individuals  submitting  or  named  in  the  reports. 

ASRS  reports  tend  to  be  sketchy  by  nature,  however,  further  “sani t.i zi nq"  of 
the  reports  can  be  practiced.  It  is  suggested  that  additional  data  such  as 
airplane  model  and  dates  should  he  made  available  to  legitimate  research 
efforts.  A  more  detailed  submittal  form  requirement  and  a  more  detailed 
follow-up  (CALL  BACK)  would  enhance  the  system. 

23.1.3  CRITICAL  FLIGHT  PHASES 

The  data  have  shown  that  certain  phases  of  flight  produced  more  accidents  than 
others.  Sixty  percent  of  the  accidents  occured  in  three  of  the  nine  phases  of 
flight  defined  for  the  study.  Takeoff  produced  21  percent  of  the  accidents, 
while  final  approach  contributed  23  percent  and  landing  contributed  lfi  percent. 

During  takeoff,  final  approach,  and  landing  the  flight  crew  is  exposed  to  the 
hazard  of  an  inadvertent  collision  with  the  ground.  In  these  fliqht  phases, 
the  flight  crew  experiences  the  greatest  workload,  activity,  and  opportunity 
for  irreversible  errors.  Crew  error  was  found  to  be  the  principal  cause  for 
accidents  in  the  final  approach  and  landinq  phases,  and,  althouqh  mechanical 
failures  were  more  numerous  than  crew  errors  in  accidents  during  takeoff,  the 
flight  crew  is  responsible  for  safe  recovery  from  those  mechanical  failures. 
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2.3.1 .4  MULTIPLE  FACTOR  ACCIDENTS 


The  data  indicates  that  most  of  the  accidents  were  not  the  results  of  a  single 
failure,  deviation,  mistake,  or  misjudgment;  they  were  the  result  of 
accumulating  or  compound  problems.  They  were  shown  to  be  the  result  of 
combinations  of  causes,  primary  and  contributing. 

Over  73  percent  of  the  accidents  examined  indicated  multiple  causes  for  the 
accidents.  Since  only  21  of  the  accidents  were  the  result  of  a  single  cockpit 
crew  error,  it  is  apparent  that  the  majority  of  crew  errors  were  committed  in 
conjunction  with  other  factors,  including  other  crew  factors.  Many  of  t.he 
crew  errors  were  the  result  of  improper  responses  to  situations  precipitated 
by  other  causal  factors.  In  such  cases,  instead  of  the  crew  providing  a 
recovery  from  the  situation,  they  often  aggravated  it. 

2.3.1 .5  ANALYSIS  OF  CREW  ERRORS 

Considering  both  primary  and  contributing  causal  factors  for  all  accidents, 
crew  errors  outnumbered  mechanical  failures  by  177  to  87,  or  over  2  to  1. 

When  only  the  hull-loss  accidents  which  generally  occurred  during  the  critical 
flight  phases  were  considered,  errors  attributed  to  the  crew  outnumbered 
mechanical  failures  by  132  to  14  or  5.5  to  1.  This  difference  supports  the 
suggestion  that  high  crew  activity  and  increased  workload  situations  may 
provide  an  environment  conducive  to  crew  errors. 

Air  carrier  accidents  are  extremely  complex  events;  over  73  percent  of  the 
accidents  examined  reported  multiple  causes  for  the  accident.  The  data  showed 
that  when  alerting  devices  were  reported  to  have  been  activated,  accidents 
reported  to  be  caused  by  crew  error  had  over  twice  as  many  devices  activated, 
on  the  average,  than  when  the  primary  cause  was  mechanical  failure.  It 
suggests  that  the  crews  may  respond  without  error  when  only  a  few  alerting 
devices  were  going  off,  but  may  make  errors  when  many  alerts  go  off.  Several 
situations  can  cause  a  large  number  of  simultaneous  device  activations: 
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o  Multiple  failures 


o  Major  component  fail ure--coupled  sub-components  cease  to 
function 

o  Failures  annunciated  by  many  devices. 


Compounded  failures  or  a  confusing  barrage  of  horns,  lights,  and  bells  can 
create  the  high  activity  and  stressful  environment  which  fosters  incorrect 
responses  and  failure  t.o  follow  correct  procedures. 


When  crew  error  was  the  primary  cause  (sample  of  21),  the  most  frequently 
reported  errors  were: 

Misjudged  speed,  distance,  altitude,  clearance,  etc.  (29%) 
Navigation  (19%) 

Failed  to  follow  approved  procedures  (14%). 

Table  2-1  lists  the  predominant  detailed  causal  factors  for  each  major  causal 
factor  extracted  from  the  160  accidents  in  the  data  base. 


Table  2- 1.  Predominant  Detailed  Causal  Factors  for  Each  Major  Causal  Factor 


Maior  causal  factor 

r  1 

Predominant  detailed  causal  factor 

Crew  error 

•  Failed  to  follow  approved  procedures,  directives,  instructions,  etc.  (21%J 

•  Misjudged  speed,  distance,  altitude,  clearance,  etc.  (14%) 

•  Selected  wrong  action  or  took  no  action  when  one  was  required  (11%) 

•  Inadequate  supervision  by  the  pilot  in  command  (8%l 

•  Improper  application  of  controls,  brakes,  flaps,  etc.  (7%) 

•  Navigation  error  (6%) 

•  Instruction  (person-to-person)  misunderstood,  ambiguous,  or  not  received  (6%) 

Weather 

.  Wind  (35%) 

•  Rain  and  moisture  (19%) 

•  Thunderstorms  or  tornado  (19%) 

Mechanical 

•  Fire,  flame,  smoke,  or  explosion  (16%) 

•  Corrosion,  embrittlement,  fatigue  (16%) 

•  Tire  failure  or  wheel  failure  (14%) 

•  Power  plant  (cowling,  electrical  harness,  ducts,  etc.)  (11%) 

Operational 

•  Aborted  takeoff  (29%) 

•  Ran  off  runway  129%) 

•  Taxi  (29%) 

Other 

•  Collision  (aircraft,  bird,  or  other  object)  (33%) 

•  Communications  with  ATC  or  company  (25%) 

•  Evasive  action  to  avoid  collision  (17%) 

•  Uncontrolled  altitude  or  altitude  deviations  (17%) 

2Z2  EXAMINATION  OF  THE  COCKPIT  ENVIRONMENT  (TASK  TWO) 


Although  the  results  from  the  cockpit  observation  flights  were  not  supported 
by  large  statistical  bases,  they  provided  supporting  data  tor  the  accident 
data  analyses.  Data  was  gathered  in  flights  aboard  727,  737,  DC-1'1,  and  L 101 1 
ai rcraft. 

Major  observations  include: 

o  Unwanted  Alerts  During  Critical  Flight  Phases  -  A  problem  with  current 
caution  and  warning  systems  was  found  to  be  that  of  alerts  presented  to 
the  crew  when  they  were  not  wanted.  Pilots  commented  on  getting 
low-urgency  alerts  during  certain  critical  flight  phases  and  getting 
alerts  for  situations  which  pose  no  threat. 

o  Low  incidence  of  Alerts  -  Discounting  the  nuisance  alerts,  there  were  no 
alerts  observed  in  the  52  flights. 

o  Scattered  Alert  Indications  -  The  crew  commented  on  the  fact  that  there 
were  so  many  bells,  whistles,  and  tones  in  the  cockpit,  that  it  takes  a 
few  seconds  to  determine  what  sound  was  activated  and  what  system  is 
associated  with  that  sound.  They  stated  that,  upon  receipt  off  an  alert, 
the  relevant  alert  indicator  must  first  be  located  and  the  alert  message 
understood  before  action  could  be  taken.  This  problem  is  most  prevalent 
in  older  fleet  cockpit  layouts  which  do  not  have  centralized  annunciator 
panel s. 

2 A  IMPACT  OF  CONCLUSIONS  OF  ALERTING  SYSTEM  DESIGN 

Task  Three  analyses,  based  on  the  conclusions  of  Tasks  One  and  Two,  showed 
that  a  flight  status  monitor  system  should  incorporate  the  following 
capabilities: 

o  Flight  Phase  Adaptation  -  The  system  should  have  the  capability  to 

selectively  modify  priorities  and  inhibit  logic  as  a  function  of  flight 
phase. 
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Multiple  Causes  -  The  system  should  have  the  capability  to  prioritize 
alerts  in  the  event  that  multiple  alerts  occur  and  to  integrate  alertinq 
information  to  facilitiate  crew  response. 


o  Checklist  Capability  -  The  system  should  have  the  capability  to  provide 
the  crew  with  the  proper  corrective  action(s)  and  feedback  on  the  results 
of  their  responses. 

o  Additional  alerts  -  The  system  should  have  the  capability  to  present  the 
following  alerts  as  well  as  other  system  or  operational  alerts. 

o  Navigation  error 

o  Tire  or  Wheel  Failure 

o  Collision  avoidance 

o  Aborted  takeoff 

o  Wind  shear. 

These  alerts  were  selected  using  two  criteria.  First,  they  were  significant 
in  frequency  of  occurrence  or  in  their  potential  impact,  on  operational  safety. 
Secondly,  the  implementation  of  the  alerts  requires  utilization  of  diqital 
computer  technology  (tire  or  wheel  failure  excepted). 

2.5  REQUIREMENTS  FOR  FLIGHT  MONITORING  CAPABILITY 

For  an  alerting  system  to  perform  as  a  monitor  of  flight  status,  functional 
requirements  in  addition  to  those  inherent  in  an  alerting  system  must  be 
provided.  Besides  the  requirements  for  display  functions  established  in  the 
Guidelines  (Ref.  5),  more  extensive  information  processing  and  interfacing 
must  be  provided.  The  functional  requirements  of  a  flight  status  monitor 
include  (those  in  addition  to  alerting  system  elements  are  shown  with  an 
asterisk): 
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o  MASTER  AURAL  ALERT  -  To  alert  the  crew  to  impendinq  or  existing 
conditions  that  require  their  attention,  and  to  advise  them  of  the 
alert  urgency  level. 

o  MASTER  VISUAL  ALERT  -  To  attract  the  attention  of  the  crew  and  to 
provide  preliminary  information  about  alert  urgency  level. 

o  VISUAL  INFORMATION  DISPLAY  -  To  provide  a  single  location  for  the 
presentation  of  all  warninq,  caution,  and  advisory  messages  to  the 
crew. 

o  VOICE  INFORMATION  ANNUNCIATOR  -  To  provide  voice  messaqes  of  the 
alert  when  the  pilot  must  act  rapidly,  or  to  enable  the  pilots  to 
selectively  transfer  workload  from  the  visual  channel  to  the 
auditory  channel . 

o  TIME-CRITICAL  DISPLAY  -  To  provide  a  separate  display  to  enable  the 
pilot  to  detect  and  respond  to  time-critical  alerts  accurately  and 
rapidly. 

o  INFORMATION  PROCESSING*  -  To  provide  the  computational  and  data 
handling  capability  including  flight  phase  adaption,  multiple 
alerts,  and  checklists. 

o  SENSING*  -  To  provide  sources  of  necessary  status  information. 

o  INTERFACING*  -  To  provide  for  data  exchange  between  the  system  and 

other  data  handling  systems  such  as  flight  management,  performance 
management,  flight  control,  sensor  subsystems,  navigation, 
communications,  and  maintenance  data  recordings. 

2.6  IMPLEMENTATION  CONSIDERATION 

In  order  to  provide  the  additional  requirements  established  for  the  alerting 
system,  the  system  must  be  provided  with  capabilities  in  computing  and 
processing,  sensing,  interfacing,  and  controlling  and  displaying. 
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o  Computing  and  Processing  -  Algorithms  and  logic  for  computation  of  alert, 
criteria  from  sensor  and  memory  sources  are  required;  these  might  be 
customized  for  each  aircraft  and  airlines. 

o  Sensing  -  Some  new  sensors  may  be  needed;  however,  most  of  the  sensors 
required  can  already  be  found  on  current  aircraft. 

o  Controlling  and  Displaying  -  The  technology  is  currently  available  to 
implement  the  flight  monitor  capability. 

o  Interfacing  -  Interfacing  will  be  the  same  means  as  other  avionics 

functions  on  the  aircraft:  digital  data  bus  in  the  more  sophisticated 
systems  and  hard  wiring  in  the  more  simple  systems. 

2.7  RECOMMENDED  FUTURE  ACTIVITY 

This  phase  of  the  study  has  established  the  feasibility  of  the  concept  of 
expanding  the  functions  of  the  alerting  system  to  perform  as  a  flight  status 
monitor.  Since  the  functional  requirements  of  a  flight  status  monitor 
sigificantly  add  to  the  requirements  of  the  alerting  system,  it  is  necessary 
to  take  a  systems  approach  to  defining  the  new  concept  of  a  flight  status 
monitor. 

The  concept  of  the  fliqht  status  monitor  should  be  refined  and  demonstrated  to 
be  feasible  for  implementation  into  hardware  for  flight  deck  applications. 
Following  demonstration  of  feasibility,  it  is  recommended  that  a  flightworthy 
system  he  fabricated  for  evaluation  in  an  operational  environment.  Finally, 
it  is  recommended  that  the  concept  system  be  evaluated  in  a  flight  test. 
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3.0  TASK  ONE-EXAMINATION  AND  ANALYSIS  OF  ACCIDENT/INCIDENT  DATA 

Existing  data  bases  were  analyzed  to  identify  the  factors  contributing  to  the 
accidents  and  incidents.  The  review  extracted  those  situations  and  failures 
that  created  hazardous  conditions.  Those  situations  or  failures,  coupled  with 
data  extracted  from  the  Task  Two  examination  of  the  operational  environment, 
were  used  in  Task  Three  to  develop  expanded  concepts  for  alerting  systems  to 
provide  a  flight  status  monitor  capability. 

3.1  OBJECTIVES 

The  primary  objective  of  Task  One  was  to  analyze  aircraft  accident  and  inci¬ 
dent  data  and  identify  the  major  contributing  causal  factors.  The  investi¬ 
gation  also  identified  flight  crew  and  alerting  system  activity  in  each 
accident  and  included  the  examination  of  possible  interrelationships  between 
causal  factors. 

Of  particular  interest  were  those  causal  factors  which  occurred  frequently  be¬ 
cause  they  represented  recurrent  or  unsolved  problems;  also  of  interest  were 
those  factors  which  occurred  infrequently  but  with  significant  impact. 

Analyses  were  performed  to  identify  interdependent  relationships,  for  example, 
the  major  causes  of  accidents/incidents  by  flight  phase  (i.e.,  separate 
tabulations  were  made  for  takeoff,  climb,  cruise,  and  landing). 

Other  questions  that  were  addressed  included: 

o  What  problems/failures  go  undetected  and  are  therefore  not  announced 
to  the  crew? 

o  What  sensors  could  be  developed  that  would  lessen  the  probability  of 
occurrence  or  decrease  the  severity  of  a  problem  situation? 

o  Could  the  inclusion  of  new  alerts  or  the  reformatting  of  existing 
ones  help  prevent  future  accidents? 
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3.2  TECHNICAL  APPROACH 


The  accident/incident  data  used  in  this  study  was  taken  from  several  data 
sources.  The  data  bases  were  divided  among  the  corporate  team  members;  one 
member  reviewed  all  ASRS  data,  while  the  other  two  participants  reviewed  all 
other  sources  including  company  accident/ incident  data  sources.  In  addition, 
to  simplify  identification  of  causal  factors  and  tabulating  results,  a  com¬ 
puter  program  was  structured  to  allow  statistical  analysis  of  the  data.  A 
data  partitioning  capability  was  also  provided  so  that  analyses  could  be 
performed  to  investigate  possible  interrelationships  between  causal  factors. 

3.3  PROCEDURES 

Task  One  was  accomplished  by  assigning  the  data  bases  to  be  surveyed  by  each 
team  member.  One  team  member  surveyed  the  ASRS  data,  provided  by  the  FAA. 
Each  of  the  other  two  team  members  reviewed  NTSB  and  other  sources  coverinq 
accidents/incidents  which  involved  the  airplanes  manufactured  by  their  com¬ 
pany.  Each  team  member  was  responsible  for  documenting  their  survey  results. 
Documentation  consisted  of  entering  the  information  on  a  standard  data 
collection  form. 

After  the  data  was  collected,  a  statistical  analysis  was  performed  to 
determine  if  any  dominant  cause  existed  and  to  support  a  parametric  study  of 
the  operational,  crew  performance,  and  alerting  system  performance  data. 

3.3.1  DATA  SOURCES 

The  sources  of  data  for  this  survey  included  reports  from  ASRS,  NTSB,  foreign 
governments,  ICAO,  and  company  in-house  files.  Figure  3-1  indicates  the 
number  of  times  each  of  the  data  sources  was  used  as  primary  or  secondary 
source  of  Information  to  be  entered  on  the  data  collection  form. 
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OCCURRENCES 


F fare  3-1.  Source  of  Deta 


As  stated  earlier,  the  term  NTSB  was  used  to  identify  all  data  sources  other 
than  ASRS  data  that  were  used  in  this  accident  data  analysis.  The  NTSB  docu¬ 
ments  were  the  primary  source  of  information  in  over  64  percent  of  the 
accidents  reviewed.  Because  of  the  difficulty  in  correlating  accidents 
reported  in  the  ASRS  with  NTSB  reports,  ASRS  data  collection,  analysis,  and 
findings  were  treated  separately.  Section  3.4.2  contains  the  results  of  the 
ASRS  survey. 
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ASRS  reports  in  the  following  seven  categories  were  analyzed.  The  categories 
were  selected  by  the  contract  monitor  to  provide  a  large  source  of  crew  errors 
to  examine. 

o  Altitude  Alerting 

o  Ground  Proximity  Warning  System  (GPWS) 

o  False  Alarms 

o  Checklists 

o  Cockpit  Displays 

o  Aircraft  Equipment  Malfunctions 

o  Alerts  and  Warnings 

On  approximately  May  1,  1978,  significant  improvements  were  instituted  in  ASRS 
data  processing;  this  date  represents  roughly  the  division  between  ASRS  Data 
Bases  1  and  2.  Table  3-1  lists  the  categories  and  numbers  of  reports 
received/analyzed.  There  was  insufficient  time  to  analyze  all  reports 
received.  In  general,  priority  was  given  to  ASRS  Data  Base  2.  A  total  of  163 
ASRS  reports  were  reviewed. 


Table  3- 1.  ASRS  Data  Sample 


Data 

Reports 

Reports 

base 

received 

analyzed 

Altitude  alerting 

1 

84 

20 

2 

125 

40 

GPWS 

1 

25 

_ 

2 

14 

13 

False  alarms 

1 

1C 

10 

2 

10 

10 

Checklists 

1 

22 

22 

2 

18 

18 

Cockpit  displays 

1 

4 

_ 

2 

54 

10+ 

Equipment  malfunctions 

1 

30 

2 

61 

10+ 

Alerts  and  warnings 

_Lj 

16 

10+ 
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ASRS  reports  tend  to  be  sketchy  by  nature.  In  addition,  significant 
information  is  frequently  omitted  from  the  reports  when  they  are  released. 
Examples  are  omission  of  airplane  model,  dates,  and  aircrew  position.  An 
early  conclusion  of  this  study  is  that  less  "sanitized"  data  should  be  made 
available  to  future  research  efforts.  A  more  detailed  submittal  form  and  a 
more  detailed  follow-up  requirement  would  enhance  the  usefulness  of  ASRS  data. 
It  is  possible  that  more  information  could  have  been  extracted  from  the 
system;  however,  this  was  impractical  within  the  time  constraints  of  the 
present  program. 

3 32  DATA  ANALYSIS 

The  analysis  of  NTSB  data  was  performed  by  computer  tabulation  of  the  occur¬ 
rence  of  each  causal  factor  as  entered  from  the  accident  data  forms.  The  data 
was  then  partitioned  so  that  the  causal  factors  were  tabulated  by  flight 
phase,  activation  of  alerting  devices  and  cockpit  indication  of  causal 
factors.  Finally,  combinations  of  variables  were  examined,  such  as  activation 
of  alerting  devices  and  cockpit  indication  of  causal  factors.  In  each  case 
the  frequency  of  occurrence,  either  independently  or  in  combination  with  other 
factors,  was  the  principal  analysis  objective. 

The  ASRS  data  analysis  was  accomplished  by  developing  a  matrix  to  tabulate  the 
frequency  of  occurrence  of  the  causal  factors  as  a  function  of  the  seven  alert 
categories.  This  analysis  procedure  facilitated  the  determination  of  trends 
in  the  data.  Again,  frequency  of  occurrence  was  used  to  provide  a  measure  of 
the  significance  of  the  causal  factors. 

3.3.3  STATISTICAL  ANALYSIS 

The  statistical  analysis  consisted  of  computing  means  and  standard  deviations 
for  selected  parameters  and  tabulation  of  individual  and  combinations  of 
causal  factors. 
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3 A  RESULTS 


34.1  RESULTS  OF  THE  NTSB  SURVEY 

The  results  of  the  analysis  of  the  NTSB  data  are  presented  below. 

34.1.1  DATA  INPUT  FORM  QUESTIONS 

The  data  input  form,  designed  for  this  accident  history  review,  contained 
three  basic  types  of  information:  reference,  system  and  crew  operating,  and 
causal  factor.  Anticipating  some  difficulty  in  finding  sufficient  data  to 
perform  an  evaluation  of  crew  and  crew  alerting  system  performance,  several 
direct  questions  were  put  on  the  form.  The  questions  were  specific  so 
conclusions  could  be  drawn  regarding  the  completeness  of  the  accident 
summaries.  The  first  question  of  this  nature  was,  "Were  any  crew-alerting 
devices  activated?" 


Figure  3-2.  Cnw-Ahrting  Devices  Activated 
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Figure  3-2  shows  that  in  66  (41  percent)  of  the  accidents  it  was  unknown 
whether  any  crew  alerting  devices  were  activated,  according  to  the  accident 
histories.  Further,  it  is  noted  that  the  entry  for  "NO”  (alerting  devices 
activated)  may  include  instances  where  the  report  simply  did  not  state  that 
devices  were  activated.  This  is  most  relevant  for  visual  alerts  which  aren't 
recorded  (aural s  are  recorded  on  the  cockpit  voice  recorder).  In  only  18 
percent  of  the  accidents  were  the  analysts  able  to  record  that  alerting 
devices  were  activated  at  the  time  of  the  accident. 

Figure  3-3  illustrates  what  types  of  alerting  devices  were  reported  in  the  160 
accident/  incident  reports.  Multiple  device  activations  in  an  accident  are 
possible.  Although  it  is  used  for  a  single  fault,  the  tactile  alert  for  stall 
warning  was  reported  almost  half  as  many  times  as  visual  alerts,  which  are 
used  for  many  alerting  functions. 


Figure  3-3.  Types  of  Alerting  Devices  Activated 
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Figure  3-4  shows  the  data  response  to  the  question,  "Were  any  of  the  alerts 
for  system  failures  false  alarms?"  In  the  vast  majority  of  cases  insufficient 
data  was  provided  in  the  data  bases  to  answer  this  question. 


Figure  3-4.  False  Alarms 

Figure  3-5  shows  that  in  only  89  (40  percent)  of  the  reports  could  it  be 
determined  whether  the  crew  had  taken  the  appropriate  action  for  the 
malfunction.  The  figure  also  shows  that  crew  action  was  inappropriate  for  the 
causal  factor  which  caused  the  accident  39  times  and  appropriate  only  25  times. 


Figure  3-5.  Corrective  Action  Appropriate 
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Figure  3-6  illustrates  the  data  response  to  the  question  of  whether  the  crew 
was  provided  with  an  indication  of  the  causal  factors.  The  fiqure  indicates 
that  in  99  (61  percent)  of  the  accidents  the  analysts  were  uncertain  whether 
the  crews  were  provided  such  an  indication.  The  data  shows  that  when  the 
analyst  was  able  to  find  sufficient  information  so  that  a  definitive  yes/no 
entry  could  be  made,  the  crew  was  not.  given  an  indication  of  the  causal  factor 
almost  80  percent,  of  the  time. 


Figure  3-6.  Indication  of  Fault  Provided  to  Crew 

The  results  for,  "Who  performed  the  corrective  action?"  are  shown  in  Fiqure 
3-7.  The  figure  shows  that  in  120  cases  it  was  unknown,  but  when  it  was 
recorded,  the  pilot  at  the  controls  when  the  situation  occurred  performed  the 
corrective  action.  The  data  contained  no  instances  when  the  corrective  action 
was  taken  by  the  flight  engineer;  this  draws  attention  to  the  fact  that  the 
data  were  derived  from  accident  summaries  which  documented  predominantly 
catastrophic  or  serious  accidents.  The  flight  engineer  would  take  corrective 
action  normally  on  only  less  critical  functions. 
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Figure  3-7.  Pitot  Performing  the  Corrective  Action 

Figure  3-8  indicates  that  the  captain  was  at  the  controls  between  51  and  76 
percent  of  the  time  when  the  situation  occurred.  The  use  of  the  term 
"switched"  covers  those  instances  where  control  of  the  airplane  shifted 
between  the  pilots  during  the  handling  of  the  emergency. 
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Figure  3-8.  Pitot  et  the  Controh  at  the  Time  of  the  Accident 
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34.1 .2  MAJOR  CAUSAL  FACTORS 


The  data  input  form  used  by  the  analysts,  and  illustrated  in  Appendix  A, 
listed  two  levels  of  causal  factors.  The  first  level  was  defined  as  MAJOR, 
and  the  second  level  was  defined  as  DETAILED,  so  that  each  major  factor 
included  one  or  more  detailed  factors.  Figure  3-9  shows  the  frequency  of  the 
major  causal  factors.  There  were  more  major  causal  factors  (343)  than 
accidents  (160)  because  the  analyst  was  permitted  to  log  up  to  five  for  each 
accident.  Major  causal  factors  were  categorized  as  being  either  primary  or 
contributing  causes  for  the  accident  as  shown  on  Page  A-4  of  Appendix  A.  The 
figure  illustrates  that  crew  errors  were  predominant  and  led  mechanical 
factors  by  177  to  fi7  (includes  both  primary  and  contributing  causes). 
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Figure  3-9.  Major  Causa!  Factors 


34.1.3  CAUSAL  FACTORS  WITHIN  MAJOR  CATEGORIES 

To  probe  deeper  into  the  major  factors  which  were  listed  as  primary  causes  for 
the  accidents,  the  data  was  partitioned  as  shown  in  the  next  series  of  figures. 
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Figure  3-10  shows  the  detailed  causal  factors  when  cockpit  crew  error  was 
listed  as  a  primary  cause  (150  times).  Pilot  failure  to  follow  approved 
procedures  was  reported  31  times  and  pilot  misjudgement  of  speed,  distance, 
altitude,  clearance,  or  other  similar  parameters  was  reported  21  times.  The 
identification  of  the  numerically  coded  causal  factors  can  be  found  in  the 
data  input  form  in  Appendix  A,  beginning  on  Page  A- 5. 
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Figure  3- 10.  Cockpit  Crew  Error  as  Primary  Causa!  Factors 
Figure  3-11  is  a  breakout  of  the  detailed  causal  factors  when  weather  was 

listed  as  a  primary  cause  (31  times).  Wind,  the  most  frequently  recorded 
factor,  includes  wind  shear. 
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Figure  3- 1 1.  Weather  Factor  at  Primary  Causal  Factors 


Figure  3-12  shows  the  detailed  causal  factors  involved  when  mechanical  factor 
was  listed  as  a  primary  cause  (64  times). 


CAUSAL  FACTOR 

Figure  3-12.  Mechanical  Factor  as  Primary  Causal  Factors 
Figure  3-13  shows  the  detailed  causal  factors  involved  when  operational  factor 


was  listed  as  a  primary  cause  (7  times). 
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Figure  3-13.  Operational  Factor  as  Primary  Causal  Factors 


Figure  3-13 
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The  detailed  causal  factors  involved  when  OTHER  factor  was  listed  as  a  primary 
cause  (12  sample),  are  shown  in  Figure  3-14.  This  category  is  comprised  of  a 
set  of  five  detailed  causal  factors  as  shown  in  Appendix  A.  The  category 
contains  those  causal  factors  which  aren't  typical  of  any  particular  phase  of 
flight.  Experience  has  shown  that  this  category  could  be  expanded,  or 
integrated  with  the  OPERATIONAL  category. 


CAUSAL  FACTOR 

Figure  3- 14.  Other  Factor  as  Primary  Causa /  Factors 
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3.4.1.4  ACCIDENT  CAUSES  BY  FLIGHT  PHASE 

One  of  the  questions  whi c h  was  addressed  in  this  survey  of  accident  histories 
was  what  causal  factors  were  prevalent  in  each  of  nine  flight  phases.  The 
flight  phases,  or  flight  segments,  defined  for  the  task  were: 

o  Takeoff  -  addition  of  power  for  takeoff  to  established 

in  a  climb 

o  Initial  climb  -  established  in  climb  to  initial  flap  retraction 

o  Climb  -  initial  flap  retraction  to  level -off  at  ATC 

assigned  cruise  altitude 

o  Cruise  -  maintaining  enroute  assiqned  cruise  altitude(s) 

to  descent 

o  Descent  -  initial  descent  from  cruise  altitude  to  a  lower 

altitude  over  a  navi qati on/initial  approach  fix 

o  Initial  approach  -  navigation/initial  approach  fix  to  be  establish¬ 
ed  on  final  approach  course  configured  for 
landing;  over  outer  marker  if  ILS  utilized 

o  Final  approach  -  From  out  of  initial  approach  or  outer  marker  to 

flare  point 

o  Landing  -  from  flare  point  through  touch-down  and  landing 

roll-out 

o  Taxi  -  maneuvering  the  aircraft  on  the  ground  between 

landing  roll-out  and  the  gate  or  loading  area. 
Includes  subsequent  maneuvering  from  gate  or 
loadinq  area  to  takeoff  point  of  next 
flight. 
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The  first  cut  of  the  data  tabulated  the  frequency  of  accidents/ Incidents  in 
each  flight  phase.  Figure  3-15  shows  that  60  percent  of  the  accidents 
occurred  in  three  flight  phases;  takeoff,  final  approach,  and  landing. 
Takeoff  accounted  for  21  percent  of  the  accidents,  while  final  approach 
contributed  23  percent  and  landing  contributed  almost  16  percent. 
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Figure  3- 15.  Accidents  by  Flight  Phase 


After  determining  in  which  flight  phases  accidents  and  incidents  were  most 
likely  to  occur,  something  already  done  in  previous  safety  studies,  the  data 
were  analyzed  for  crew  errors  in  each  flight  phase.  The  data  were  partitioned 
to  show  the  relationship  of  cockpit  crew  errors  per  flight  phase  and  to  show 
what  the  detailed  causal  factors  were. 
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34.15  CAUSAL  FACTORS  BY  FLIGHT  PHASE 


The  cockpit  crew  detailed  causal  factors  reported  to  have  occurred  in  each 
flight  phase  are  presented  in  this  section.  Figure  3-16  indicates  what  crew 
errors  were  made  in  the  takeoff  phase. 


CAUSAL  FACTOR 


Figure  3-16.  Crew  Errors-  Takeoff 


Failure  to  follow  approved  procedures  contributed  5  of  the  23  reported 
occurrences.  There  were  no  pilot  errors  involving  misjudgment  of  speed, 
altitude,  distance,  clearance,  etc.,  in  the  takeoff  phase. 
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CAUSAL  FACTOR 


Figure  3- 1 7.  Crew  Errors— Initial  Climb 


Figures  3-17  and  3-18  shows  the  crew  errors  made  during  initial  climb,  and 
cl imb. 


Figure  3- 18.  Crew  Errors-Climb 


37 


Figure  3-19  indicates  that  only  5  crew  error  causal  factors  were  reported  in 
accidents  which  occurred  during  the  cruise  flight  phase.  Other  safety  reports 
have  shown  that,  although  the  cruise  phase  of  flight  entails  64  percent  of  the 
operational  time  of  a  typical  flight,  it  contributes  only  6.1  percent  of  the 
accidents  (Ref.  6). 


CAUSAL  FACTOR 

Figure  3 - 19.  Crew  Errors  -Cruise 


Figure  3-20 
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shows  the  crew  errors  made  during  descent. 


CAUSAL  FACTOR 

Figure  3-20.  Crew  Errors— Descent 
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Figure  3-21  illustrates  the  errors  made  by  the  crew  during  the  initial 
approach  phase.  This  phase  often  requires  the  crew  to  maneuver  the  aircraft 
through  an  approach  to  a  particular  point  from  which  minimum  maneuvering  to 
the  landing  runway  is  required.  Vectors  and  holdinq  may  be  involved  as  well 
as  mountainous  terrain.  Navigation  errors  constituted  over  29  percent  of  the 
errors. 
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Figure  3-21.  Crew  Errors- Initial  Approach 


Figure  3-22.  Crew  Errors— Final  Approach 
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Figure  3-22  illustrates  the  cockpit  crew  errors  made  durinq  final  approach. 

In  this  phase  the  crew  is  occupied  with  maneuvering  the  aircraft  within  strict 
limitations,  preparing  the  aircraft  for  landing,  and  attempting  to  make/keep 
visual  contact  and  reference  to  the  ground.  Pilot  mis.judqment  of  speed, 
distance,  altitude,  etc.,  accounted  for  22  percent  of  these  errors,  while  crew 
failure  to  follow  approved  procedures  contributed  18  percent. 


Figure  3-23.  Crew  Errors-Landing 


Figure  3-23  indicates  the  crew  errors  which  were  made  during  landing.  Pilot 
misjudgment  of  speed,  distance,  altitude,  clearance,  etc.,  failure  to  follow 
approved  procedures,  and  crew  selection  of  wrong  action  or  took  no  action  when 
one  was  required  accounted  for  61  percent  of  the  errors. 


Only  one  crew  error  was  reported  during  the  taxi  phase.  The  error  was, 

"Failed  to  Follow  Approved  Procedures".  It  is  noted  that,  normally,  aircraft 
ground  control  is  separate  from  approach  control  and  tower  control.  This 
requires  a  change  in  controllers  for  taxi  instruction  and  guidance,  providing 
an  opportunity  for  misunderstanding  and  error. 

34.1.6  CREW  RESPONSE  TO  ALERTING  DEVICES 

The  appropriateness  of  the  crew  response  when  alerting  devices  were  reportedly 
activated  was  investigated.  Although  the  data  sample  is  small,  Fiqure  3-24 
shows  that  even  with  alerting  devices  activated,  the  crew  took  the  wrong 
action  for  the  situation  over  30  percent  of  the  time. 


UNKNOWN  YES  NO  PROBABLE 
Figure  3-24.  Alerting  Devices  Active— Appropriate  Action 
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3.4. 1.7  CAUSAL  FACTORS  WITH  /WITHOUT  INDICATIONS 


Figure  3-25  shows  the  causal  factors  reported  when  alertinq  devices  were 
activated  and  the  crew  was  provided  an  indication  of  the  cause  for  the 
accident. 
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Figure  3-25.  Causal  Factors  With  Alerting  Devices  and  Indication  of  Cause 


Under  this  condition,  in  the  small  sample  of  18  causal  factors,  crew  errors 
constituted  67  percent  of  the  causal  factors  reported. 
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Figure  3-26.  Causal  Factors  Without  Alerting  Devices  and  Indication  of  Cause 


Fiqure  3-26  shows  the  errors  reported  when  the  crew  was  given  no  indication  of 
the  cause  and  no  alerting  devices  were  reported  to  have  been  activated.  Under 
these  conditions,  crew  errors  constituted  62  percent.  A  tabulation  of  the 
data  in  the  two  figures  is  shown  below: 


Major  Causal  Factor 


Occurrences  Occurrences 

With  Alerting  Without  Alerting 


Crew  factor 

Weather 

Mechanical 

Operational 

Other 


12  (67*) 
0 
4 
0 

J_ 

18 


34  (62%) 

11 
4 
3 

_2 

S5 
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34.1.8  FREQUENCY  OF  MULTIPLE  CAUSAL  FACTORS 


An  accident  can  be  caused  by  a  single  factor  or  a  combination  of  factors. 
Generally  accidents  are  the  result  of  combinations  of  causes,  primary  and 
contributing.  The  data  base  for  this  accident  review  contained  160  accidents, 
274  primary  causal  factors,  and  79  contributing  causal  factors.  Figure  3-27 
shows  how  many  times  multiple  causes  were  reported. 


NUMBER  OF  CAUSES 

Figure  3-27.  Frequency  of  Multiple  Causal  Factors 
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The  figure  shows  that  73  percent  of  the  accidents  surveyed  were  the  result  of 
multiple  causal  factors. 
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3.4. 1.9  TYPICAL  ACCIDENT  PROFILE 


Figure  3-28  was  developed  to  format  the  data  to  facilitate  discussion  and 
analysis.  Three  phases  of  flight,  takeoff,  final  approach,  and  landinq  worn 
selected,  since  they  produced  the  most  accidents.  The  totals  don't  correspond 
due  to  unknowns  and  other  variables  present.  The  data  can  be  read  as  follows: 


The  first  typical  profile  is  for  an  accident  which  occurred  durinq  take¬ 
off.  This  phase  contributed  33  of  160  accidents/incidents  in  the  data 
base.  The  accident  occurred  as  frequently  dav  or  night  since  16  occurred 
in  daytime  and  15  occurred  at  niqht.  The  captain  was  at  the  controls  16 
times  and  the  first,  officer  was  at  the  controls  5  times.  The  weather  was 
VMC,  but  they  were  operating  under  IFR.  If  visibility  was  restricted,  it 
was  due  to  fog.  The  autopilot  was  not  engaqed,  and  the  autothrottle  was 
not  engaqed.  The  flight  had  lasted  less  than  3  minutes.  There  was  one, 
perhaps  two,  extra  people  in  the  cockpit.  An  additional  note  is  that  the 
cause  for  the  accident  was  more  likely  mechanical  over  crew  factor  (32  to 
23),  and  the  failure  was  most  likely  tire  or  wheel  failure. 

•  Takeoff  (33-160) 

•  Equally  likely  day  or  nigh  i  <15-15* 

•  Captain  at  the  controls  (16-5) 

•  WX  VFR  (21-7) 

•  Operating  under  IFR  rules  (19-2) 

•  If  visibility  is  restricted,  it  is  due  to  fog  (8-4) 

•  Autopilot  not  engaged  ( 18-0) 

•  Autothrottle  not  engaged  (  19-0) 

•  Flight  lasted  under  3  minutes 

•  Extra  person  in  the  cockpit  (1.1 54.  o  =  1.214.  13) 

•  Final  approach  (37-160) 

•  Most  likely  daytime  (21-14) 

•  Captain  at  the  controls  (18-10) 

•  WX  IFR  (22-121 

•  Operating  under  IFR  rules  (25-7) 

•  Autopilot  not  engaged  (6-2) 

•  Autothrottle  not  engaged  (6-0) 

•  Flight  duration  1 22  minutes 

•  Extra  person  in  the  cockpit  ( 1 .61 S,  o  =  0  650.  13) 

•  Landing  (25-160) 

•  Most  likely  daytime  (15-8) 

•  Captain  at  the  controls  ( 1  5-3) 

•WX  IFR  (16-8) 

•  Operating  under  IFR  rules  (20-2) 

•  Autopilot  not  engaged  (6-0) 

•  Autothrottle  not  engaged  (6-0) 

•  Flight  duration  1 30  minutes 

•  No  extra  people  in  the  cockpit  <0.333.  a  =  0  500.  1 3 1 

Figure  3-28.  Typical  Accident  Profile 
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The  second  paragraph  should  be  read  as  follows: 

The  second  typical  profile  is  for  an  accident,  which  occurred  durino  final 
approach.  The  accident  most  likely  occurred  in  daytime,  and  the  captain 
was  at  the  controls.  The  weather  was  IMC,  and  they  were  operat.inq  under 
IFR.  The  autopilot  was  not.  engaged,  and  the  autothrot.tle  was  not 
engaged.  The  flight  had  lasted  12?  minutes,  and  there  likely  wen3  two 
extra  people  in  the  cockpit.  An  additional  note  is  that  the  most  likely 
cause  for  the  accident  was  crew  error  over  mechanical  factor  (55  t.o  4), 
and  the  most  likely  cockpit  crew  error  was  that  the  pilot,  misjudged  his 
speed,  altitude,  distance  to  the  runway,  or  some  such  parameter,  or  the 
crew  failed  to  follow  established  procedures. 

The  third  paragraph  should  be  read  as  follows: 

The  third  typical  profile  depicts  an  accident  during  the  landing  phase. 
The  accident  most  likely  occurred  during  daytime  and,  again,  the  captain 
was  at  the  controls.  The  weather  was  IMC,  and  they  were  operating  under 
IFR.  The  autopilot  was  not  engaqed,  and  the  autothrottle  was  not 
engaged.  The  flight  had  lasted  130  minutes.  There  were  no  extra  people 
on  the  flight  deck.  An  additional  note  is  that  the  most  likely  cause  for 
the  accident  was  crew  error  (36  to  R)  and  the  error  most  likely  was  pilot 
misjudgment  of  his  speed,  altitude,  or  the  crew  failed  to  follow 
established  procedure. 

3.4.2  RESULTS  OF  THE  ASRS  SURVEY 

The  results  of  the  ASRS  survey  are  presented  in  this  section.  Findings  from 
the  review  of  reports  in  the  altitude  alert,  ground  proximity,  and  false  alarm 
categories  are  presented. 
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3A.2.1  ALTITUDE  ALERTS 


The  ASRS  categorized  209  reports  of  altitude  deviation  from  assiqned  altitude 
in  the  period  7/1/76  to  2/2/BO.  These  are  commonly  called  "altitude  busts". 
Several  additional  incidents  involving  altitude  alerting  were  associated  with 
reports  in  other  categories.  A  sunmary  of  the  significant  details  of  63 
incidents  follows: 


63  Reported  "Altitude  Busts" 

Frequency 

% 

Association  with  Distraction/Added  Workload 

36 

57% 

Crew  Cross  Check  Obviously  Lacking 

34 

54% 

Altitude  Deviation  Alert  not  Seen/Heard 

24 

38% 

Clearance  Misunderstanding 

20 

32% 

Altitude  Alert  Mis/Not  Set  (Clearance  OK) 

7 

11% 

Pilot  Comment  -  Alert  Design  (Deficiency) 

19 

30% 

Crew  Reference  to  Just  (1)  Alert  Component 

14 

22% 

No  Response  until  Queried  by  ATC 

33 

52% 

Occurrences  in  Climb 

30 

48% 

Occurrences  in  Descent 

26 

41% 

Occurrences  in  Approach,  Cruise  or  Unknown 

7 

11% 

Reports  by  Pi  lots /Crewmen 

57 

92% 

Reports  by  Controllers 

5 

8% 

Actual  Potential  Hazard 

6 

10% 

A  relatively  high  percentage  of  the  deviations  (57%)  were  associated  with  some 
distraction  or  temporary  increased  workload  activity,  such  as  looking  for 
traffic,  looking  at  a  chart  or  dealing  with  a  minor  problem,  etc.. 


In  many  of  the  situations,  the  crew  occupied  themselves  with  the  distraction 
to  the  extent  that  a  double  check  (or  even  single  check)  on  acquirinq  the 
required  altitude  was  no  longer  maintained.  In  (54%)  of  the  "busts"  a  lack  of 
double  check  was  apparent.  This  number  also  includes  those  occurrences  where 
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only  one  pilot  listened  to  the  clearance  (and  got  it  wronq)  or  one  pilot 
mis- set  the  Altitude  Alert. 


A  clearance  misunderstanding  was  responsible  for  (32%)  of  the  deviations. 

This  is  a  siqnificant  number.  It  underlines  the  importance  of  both  crew¬ 
members  listening  to  (and  agreeing  on)  the  clearance  as  well  as  a  requirement 
to  "read  it  back". 

One  report  included  a  very  interesting  suggestion:  "...That  the  Altitude 
Alert  setting  be  transmitted  back  to  the  ground".  This  is  feasible  with  the 
development  of  the  data  link  technology.  The  potential  error  reduction 
includes  not  only  the  32%  of  clearance  misunderstandings,  hut  a  portion  of  the 
11%  additional  deviations  where  the  clearance  was  understood  at  the  time,  but 
a  mis-set  altitude  alert  became  a  factor  later. 

Probably  one  of  the  most  significant  statistics  is  that  the  Altitude  Alert 
(correctly  set)  was  not  seen  or  hearl  in  38%  of  the  incidents.  The  aural 
Altitude  Deviation  Alert  (usually  one  C-chord  tone/beep)  is  apparently 
degraded  by  the  fact  that  it  is  also  used  for  the  Altitude  Approach  Alert  --  a 
very  common  cockpit  sound.  It  would  certainly  appear  that  the  deviation  aural 
alert  should  be  distinctly  different  or  repetitious  until  the  deviation  is 
corrected  (or  reset). 

The  reports  referred  to  a  single  deviation  alert  component  in  22%  of  the  cases 
-  usually  the  aural.  This  suggests  limitations  in  the  visual  signal  as  well, 
since  most  transports  have  both.  The  deviation  alert  light  is  usually 
repetitious,  but  it  is  frequently  colored  blue  or  white.  An  inference  or  a 
direct  comment  on  the  inadequacies  of  existinq  Altitude  Alertina  was  noted  in 
38%  of  the  reports. 

The  problem  has  been  most  acute  with  the  smaller  transports,  as  indicated  by 
the  38%  "busts”  in  the  737,  DC-9  category,  and  an  additional  22%  for  even 
smaller  aircraft.  The  smaller  transports  have  a  far  greater  exposure,  hear 
the  C-chord  more  often,  etc..  Conversely,  only  2  of  the  63  reports  are 


48 


believed  to  have  been  from  wide-body  aircraft.  The  wide  bodies  (and  later 
model  737' s,  DC-9‘s  and  727' s)  are  noted  to  have  autopilot  altitude  captures. 

There  has  been  some  industry  and  government  recognition  of  the  problem. 

Federal  Aviation  Regulation  (FAR)  91.51  originally  required  both  aural  and 
visual  alerts  for  altitude  approach  and  altitude  deviation.  Amendment  91-142 
dated  August  22,  1 ^81  permits  a  configuration  with  only  visual  signals  for 
altitude  approach  and  an  aural  signal  for  deviation.  The  rule  revision  is  an 
attempt  to  make  the  aural  alert  more  effective  for  "deviation”  by  deleting  its 
requirement  for  "approach".  At  least  one  major  airline  (United  Air  Lines)  is 
in  the  process  of  modifying  existing  fleets  to  this  configuration. 

3A22  GROUND  PROXIMITY  WARNING  SYSTEM  ALERTS 

Thirteen  reports  were  reviewed  involving  terrain  warning  devices.  Of  these, 
ten  incidents  were  associated  with  airborne  systems,  two  were  tower- reported 
low-altitude  alerts,  and  one  was  an  enroute  controller-reported  terrain  alert. 
Of  the  ten  airborne  system  alerts,  two  represented  probable  system  malfunc¬ 
tions,  the  remainder  being  valid  alerts,  i.e.,  the  GPWS  was  operating  as 
designed. 

The  most  common  cau^e  (4  cases)  of  the  valid  GPWS  alerts  was  a  pi 1 ot- induced 
alert  by  making  a  steep  descent  to  the  final  approach  path  during  visual 
approach.  This  is  generally  attributed  to  poor  planning  on  the  part  of  flight 
crews.  Contribu'. ing  factors  were  ATC  altitude  restrictions  (3  cases)  and 
reduced  visibility  (1  case). 

The  second  most  common  cause  (3  cases)  of  valid  GPWS  alerts  was  associated 
with  ATC  vectors  into  areas  where  Mode  2  warnings  were  generated  due  to 
terrain  clearance  and  closure  rate,  even  though  the  aircraft  was  in  level 
flight  or  a  shallow  descent.  These  occurrences  indicate  a  basic 
incompatibility  between  ATC  procedures  and  GPWS  desiqn  criteria. 

The  remaining  valid  GPWS  alert  was  attributed  to  high  sink  rate  caused  by 
severe  atmospheric  conditions  during  approach. 
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Of  the  tower-reported  low-altitude  alerts,  one  was  attributed  to  altitude  loss 
associated  with  severe  atmospheric  conditions,  and  one  represents  a  probable 
poor  calibration  of  tower  equipment. 

The  ATC-reported  terrain  alert,  was  associated  with  ATC  vectors  into  rising 
terrain  for  traffic  purposes. 

It  is  interesting  to  note  that  60%  of  the  airborne  GPWS  alerts  were  associated 
with  causal  factors  involving  ATC  procedures,  while  only  20%  represented 
probable  equipment  failures.  The  ATC  procedures  involved  were  vectors  over 
rising  terrain  and  late  descent  clearance  for  visual  approaches.  The  latter 
is  not  considered  a  particularly  significant  GPWS  problem,  since  they  occur  in 
visual  conditions  and  the  flight  crews  are  generally  aware  of  the  cause  of  the 
al ert. 

On  the  other  hand,  the  ATC  vector  over  rising  terrain  in  instrument  conditions 
clearly  represents  a  significant  problem  in  that  the  flight  crew  is  faced  with 
the  choice  of  ignoring  the  alert  or  leaving  an  assigned  altitude,  both  of 
which  are  potentially  hazardous. 

3AJ2.3  FALSE  ALARMS 

The  ASRS  categorized  only  20  false  alarms  from  7/1/76  to  2/2/80  in  a  total  of 
nearly  18,000  reports.  This  is  remarkable  in  itself,  but  it  is  more 
remarkable  considering  that  2  of  the  reports  concerned  the  same  incident,  3 
others  were  of  ground-based  origin,  and  6  were  GPWS  --  5  of  those  6  were  from 
the  dubious  ASRS  Data  Base  1  which  was  compiled  during  the  period  of  the 
introduction  and  the  difficult  adjustment  for  GPWS. 

Four  alarms  were  for  engine  fire  -  probably  all  really  false  -  but  still  a 
very  low  number  overall.  The  low  number  of  false  alarm  reports  is  impressive. 

Two  of  the  ground-based  reports  involved  false  glide  slope  indications  on 
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Instrument  Landing  System  (ILS)  approaches,  one  of  them  on  the  "back  course". 
False  glide  slopes  are  not  an  unusual  phenomenon  and  have  become  more  common 
with  our  more  advanced  airplanes  using  higher  sensitivity  glide  slope 
receivers  for  improved  autopilot  performance.  One  obvious  solution  is  to 
clearly  indicate  on  approach  charts  those  ILS  installations  where  false  glide 
slope  characteristics  prevail  (front  or  back  course). 

Overall,  while  it  is  not  intended  to  be  a  criticism  of  ASRS,  it  seems  that 
airborne  false  alarms  (and  warninqs)  have  been  a  more  significant  problem  than 
indicated  by  only  20  false  alarm  reports  out  of  18,000  total  ASRS  reports. 
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4.0  TASK  TWO-EXAMINATION  OF  THE  COCKPIT  ENVIRONMENT 


The  examination  of  the  cockpit  environment  consisted  of  ridinq  in  the  flight 
station  during  commercial  airlines  flights  to  observe  cockpit  activity  and 
flight  operations  and  to  obtain  pilot  comments  on  (present  day)  systems  that 
are  predominant  in  the  fleet  today. 

4.1  OBJECTIVES 

The  objectives  of  this  task  were  to  familiarize  the  investigators  with  the 
operational  environment,  to  identify  the  factors  which  influence  pilot  perform¬ 
ance,  to  obtain  an  input  from  the  line  pilot  community  regarding  alerting 
system  operation  and  function,  and  to  obtain  a  baseline  for  assessing  alerting 
system  performance  and  proposed  improvements.  The  investigators  participated 
in  routine  commercial  flights  to  observe  and  record  cockpit  operations,  pro¬ 
cedures,  and  crewmember  activity.  The  task  permitted  the  investigators  to 
observe  the  compatibility  of  equipment  and  procedures  under  the  influences  of 
operational  environment,  weather  conditions,  communications  requirements,  crew 
coordination,  and  crew  activity.  In  addition,  the  task  provided  the  investiga¬ 
tors  with  an  improved  understanding  of  the  operating  environment  to  better 
understand  accident  data  and  the  frequently  complex  evolution  of  aircraft 
accidents . 

42  TECHNICAL  APPROACH 

The  philosophy  of  the  examination  of  the  operational  environment  was  to 
observe,  first  hand,  flight  operations  during  routine  airline  flights.  A 
mixture  of  flights  were  made;  some  were  flights  of  lonq  duration  and  some  were 
short  hops.  A  mixture  of  daylight/darkness,  VFR/IFR  and  even  ?-man  crew/3-man 
crew  flights  were  made.  The  nature  of  the  project  was  explained  to  the  crew, 
and  the  flight  crews  responded  to  questions  and  commented  on  crew  alerting  and 
operational  procedures.  The  investigators  maintained  a  low  profile  and  did 
not  interfere  with  normal  crew  activities. 
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The  investigators,  through  the  course  of  the  task,  were  able  to  observe  and 
accompany  the  flight  crews  through  all  the  steps  of  a  typical  flight  from 
pre-flight  through  post- flight. 

4.3  PROCEDURES 

It  was  necessary  for  each  participating  team  member  to  request  jump-seat 
authorization  directly  with  the  airline  on  which  flights  were  desired. 
Jump-seat  is  the  term  applied  to  the  extra  seats  in  the  cockpit,  normally 
empty,  but  available  for  authorized  observers.  The  airline,  in  turn, 
forwarded  the  request  to  the  FAA.  The  FAA  provided  written  permission,  in 
accordance  with  FAR  l21.F47(c)6,  for  the  investiqator  to  be  admitted  to  the 
fliqht  deck  of  the  aircraft  of  that  particular  airline.  The  team  member  then 
worked  with  the  airline  to  arrange  an  itinerary  of  fliqhts. 

To  make  the  most  effective  use  of  the  flight  time  and  to  ensure  that  the  team 
members'  activity  was  consistent,  a  data  collection  form  was  developed.  The 
cockpit  observation  form,  shown  in  Appendix  B,  consisted  of  three  sections. 

The  upper  portion  of  the  data  form  provided  sDace  for  biographical  and  fliqht 
data  to  identify  the  particular  flight.  This  data  included  the  names  of  the 
crewmembers,  the  name  of  the  airlines  and  the  flight  number.  It  also  included 
the  time,  date,  type  of  aircraft,  and  point  of  departure  and  destination. 

The  remaining  portion  of  the  front  page  was  the  observer’s  checklist.  It  was 
divided  into  flight  segments  and  provided  a  list  of  items  of  interest  to  be 
observed.  The  list  provided  the  observer  with  reminders  of  what  to  watch  for, 
such  as  pre- flight  activity,  take-off  procedures,  and  crew  activity  during 
approach  to  landinq.  The  list  also  provided  a  reminder  to  note  certain  items 
which  might  be  useful  later,  such  as  use  of  checklists,  autopilot,  and  the 
alerting  system.  The  back  side  of  the  form  provided  space  for  writing  up  any 
alert  that  might  occur  during  the  flight,  and  for  a  post-flight  narrative  and 
general  notes. 
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A  cockpit  observation  form  was  initiated  for  each  of  the  5?  flights.  Some  of 
the  flights  were  segment-legs  of  longer  routes  flown  by  the  crew,  such  as 
Western  Airlines  Flight  478  which  runs  from  Denver  to  Minneapolis  with  three 
stops  enroute.  Routes  and  airlines  were  chosen  to  provide  a  wide  cross- 
section  of  aircraft  types  and  flight  lengths.  On  occasion,  the  flight  crew 
was  followed  through  all  of  their  flight  legs  to  observe  their  full  flight 
schedule. 

4.4  RESULTS 

The  52  flights,  comprising  100.8  hours  of  flight  time,  produced  observations 
and  comments  that  ranged  from  often-repeated  to  single  observations.  Observa¬ 
tions  which  were  frequently  noted  included  the  prevalence  of  untimely  alerts, 
the  low  incidence  of  alerts,  and  ihe  scattered  alert  locations  in  fleet 
aircraft. 

4.4.1  NUISANCE  ALERTS 

A  problem  with  current  crew  alerting  systems  was  found  to  be  that  of  nuisance 
alerts,  which  consist  of  unwanted,  unnecessary,  or  untimely  alerts.  Pilots 
were  critical  of  qettinq  alerts  when  no  threat  existed,  or  when  the  situation 
was  pilot  induced  and  anticipated.  Examples  of  these  include  the  configura¬ 
tion  alet'  when  the  action  of  reducing  power  for  let-down  was  mismatched  with 
the  up  position  of  the  landing  gear.  The  crews  customarily  inhibited  the 
"qear  not  down"  alert  in  those  situations.  Another  alert,  frequently 
encountered,  was  that  of  the  altitude  alert.  This  alert,  described  in  Section 
3.4. 2.1,  is  a  source  of  concern  in  that  the  same  C-chord  tone  is  used  to 
announce  an  ALTITUDE  DEVIATION  alert  as  well  as  the  frequently-heard  ALTITUDE 
APPROACH  alert. 

Other  alerts  which  were  termed  nuisance  alerts  involved  terrain  warninq 
devices.  The  most  common  of  these  alerts  was  the  pilot-induced  alert  caused 
by  a  steep  descent,  to  the  final  approach  path  during  visual  approaches. 


Whether  caused  by  a  late  descent  clearance  or  by  a  letdown  at  pilot's 
discretion,  the  result  was  a  rapid  descent  which  triqqered  the  alert.  The 
second  most  common  GPWS  alert  was  the  ATC-induced  alert  for  terrain  clearance. 
These  alerts  are  associated  with  ATC  vectors  over  hill'  terrain. 

The  pilots  were  also  critical  of  gettinq  low-urqency  alerts  when  they  were 
busy  flyinq  the  airplane.  Almost  all  the  takeoffs  and  landinqs  were  flown 
manually.  Most  airlines  had  some  policy  concerning  conversation  in  the  cockpit 
during  these  flight  phases,  and  on  one  occasion,  a  flight  engineer  refrained 
from  informing  the  pilot  of  a  slight  rise  in  constant-speed-drive  oil  tempera¬ 
ture  durinq  takeoff.  Durinq  these  hiqh-acti vity  flight  phases  conversation 
was  limited  to  the  challenges  and  responses  to  the  various  checklists,  the 
speed  call-outs  during  takeoff,  and  the  altitude  and  speed  call-outs  during 
landing. 

4.4.2  FREQUENCY  OF  ALERTS 

No  alerts  that  required  a  response  were  observed  during  the  5?  flights,  nor 
were  any  false  alarms  observed.  All  the  altitude  alerts  and  the  GPWS  alerts 
which  were  defined  as  nuisance  alerts  were  proper  alerts  generated  by  properly- 
operating  equipment. 

44.3  VARIETY  OF  DISPLAY  LOCATIONS 

A  wide  variety  of  crew  alerting  designs  and  display  locations  were  observed. 
Data  was  gathered  in  737,  727,  DC-10,  and  L 101 1  aircraft.  While  all  the  crews 
were  used  to  their  cockpit  display  layout,  some  crews  complained  that  the 
alert  lights  were  too  spread  out,  and  there  were  too  many  alerting  tones. 

These  observations  support  earlier  findings  (Ref.  3). 

44.4  MISCELLANEOUS  OBSERVATIONS 

In  addition  to  the  primary  concerns  discussed  above,  other  comments  and 
observations  were: 
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All  flights  were  flown  without  incident 


o  There  were  no  missed  approaches  made 

o  On  one  occasion  an  aural  alert  blocked  out  an  ATC  call 

o  Some  crews  complained  of  high  noise  levels  in  the  cockpit 

o  Some  crews  expressed  a  need  for  b<  /*r  ground/ ramp  control 

o  All  the  crews  were  concerned  with  collision  avoidance,  especially 
during  takeoff  and  landing. 
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5.0  CONCLUSIONS  FROM  TASKS  ONE  AND  TWO 

5.1  LIMITATIONS  OF  THE  DATA  BASES 

Two  data  bases  were  developed  in  the  study.  One  data  base  came  from  NTSB-type 
reports  and  the  second  was  drawn  from  the  ASRS.  The  term  NTSB  has  been  used 
throughout  this  report  t.o  identify  all  data  sources,  other  than  the  ASRS. 
Because  of  the  significant  differences  between  the  data  recorded  in  the  NTSB 
accident  reports  and  the  data  recorded  in  the  ASRS  reports,  the  ASRS  data  was 
collected,  analyzed,  and  reported  separately.  The  ASRS  reports  were  provided 
by  the  FAA  contract  monitor;  the  NTSB  data  was  collected,  or  al ready  held,  by 
the  participating  companies.  The  NTSB  data  base  was  the  primary  source  for 
the  data  used  in  the  study.  The  ASRS  provided  supporting  or  supplementary 
data . 

5.1.1  LIMITATIONS  OF  THE  NTSB  DATA  BASE 

The  NTSB  data  base  consisted  of  160  accidents/incidents.  Data  was  drawn  from 
accident  reports  from  NTSB/CAB,  foreign  government,  ICAO,  and  in-house  files. 
Of  the  160  accidents/incidents  examined  09  were  hull-loss  accidents,  BO 
resulted  in  substantial  damage,  27  resulted  in  minor  damage,  and  only  14 
resulted  in  no  damage  to  the  aircraft. 

While  such  figures  indicate  quantity  in  a  data  base,  they  don't  readily  convey 
the  quality,  or  content  of  the  data.  The  types  of  accidents  in  the  data 
sample,  whether  the  airplane  was  destroyed,  whether  there  were  survivors,  can 
affect  an  analysis  of  causal  factors,  crew  performance,  and  alerting  system 
operation.  In  determining  the  probable  cause! s)  of  an  accident,  all  facts, 
conditions,  and  circumstances  are  considered  by  the  accident  investigators. 

The  objective  is  to  ascertain  those  cause-and-effect  relationships  that 
existed  in  the  accident  sequence.  If  the  crew  doesn't  survive  so  there  is  no 
one  to  interrogate,  the  course  of  the  investigation  is  committed  to  sifting 
through  the  wreckage,  studying  the  clues  and  the  voice  and  crash  recorders, 
and  attempting  to  determine  what  the  airplane  did  and  what  the  crew  did. 
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A  majority  of  accidents  which  result  in  the  destruction  of  the  aircraft  are 
determined  to  be  caused  by  crew  error.  In  a  recent  study  of  609  accidents  of 
all  types,  crew  error  was  cited  as  the  probable  cause  in  66.4  oercent  of  them 
(Ref.  6).  The  figure  jumped  to  77.4  percent  when  only  hull-loss  accidents  were 
considered.  Since  293  of  the  609  accidents  were  hull-loss,  the  percentage  of 
crew  error  in  the  non-hull -loss  accidents  was  about  56  percent.  These  data 
indicate  that  crew  error  was  cited  as  the  probable  cause  for  accidents  more 
ftequently  when  the  aircraft  was  destroyed. 

The  data  from  this  accident  review  also  showed  a  correlation  between  loss  of 
aircraft  and  crew  causal  factors.  The  analysts  reported  43  accidents  for 
which  only  one  cause  was  apparent.  The  relationship  of  causal  factor  to 
aircraft  damage  sustained  is  shown  below: 

Aircraft  Damage 


Number 

Causal  Factor 

Destroyed 

Substantial 

Mi  nor 

None 

21 

Cockpit  crew 

21 

0 

0 

0 

3 

Weather 

1 

0 

2 

0 

9 

Mechanical 

3 

1 

2 

3 

0 

Operations 

0 

0 

0 

n 

3 

Other 

2 

0 

0 

1 

7 

Unknown 

5 

1 

1 

0 

It  is  noteworthy  that  every 

crew-caused 

accident  was  a 

hull -loss  accident. 

Equally 

important,  however. 

is  that  when 

the  crew  is  lost  with 

the  aircraft, 

little  data  is  available  to  evaluate  the  performance  of  the  crew  or  the 
alerting  system. 

Selecting  a  large  number  of  hull -loss  accidents  to  review  carried  a  penalty 
for  the  survey.  Although  selecting  a  large  number  of  hull -loss  accidents 
portended  a  large  number  of  crew-error  accidents  in  the  sample,  the  accident 
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sunmaries  provided  a  minimum  of  data  on  crew  activity  and  alerting  system 
performance. 

5.12  LIMITATIONS  OF  THE  ASRS  DATA  BASE 

ASRS  reports  are  submitted  voluntarily  by  participants  in  the  aviation  com¬ 
munity.  After  preliminary  processing,  all  ASRS  reports  are  marked  so  that 
there  is  no  way  to  identify  individuals  submitting  or  named  in  the  reports. 
ASRS  reports  tend  to  be  sketchy  by  nature,  however  further  "sanitizing"  of  the 
reports  has  been  practiced.  It  is  suggested  that  additional  data  such  as  air¬ 
plane  model  and  dates  should  be  made  available  to  legitimate  research  efforts. 
A  more  detailed  submittal  form  requirement  and  a  more  detailed  follow-up  (CALL 
BACK)  would  enhance  the  system. 

The  ASRS  was  initiated  in  July  1976.  In  May  1978  significant  improvements 
were  made  in  the  data  processing  which  resulted  in  a  higher  quality  system. 

The  data  from  both  time  periods  were  reviewed,  but  a  priority  was  given  to  the 
later,  improved  system  reports. 

5.1.3  LACK  OF  CREW  AND  ALERTING  SYSTEM  PERFORMANCE  DATA 

It  became  evident  during  the  examination  of  the  NTSB  accident  data  that  there 
is  a  paucity  of  data  in  the  accident/incident  reports  concerning  crew 
performance  or  the  status  or  activity  of  the  crew  alerting  system.  Such  data 
would  have  been  extremely  useful  in  this  study  and  would  enhance  any  assess¬ 
ment  of  the  performance  of  the  alerting  system  in  future  accidents/incidents. 
Such  data  would  be  of  great  value  especially  in  accidents  in  which  no  flight 
crew  members  survive.  Two  methods  to  collect,  such  data  have  been  suggested. 
They  are  wide-angle  video  cockpit  recording  and  recordinq  of  the  operation  of 
both  the  visual  and  aural  alerting  devices  in  the  cockpit. 
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5.2  CONCLUSIONS  FROM  THE  EXAMINATION  OF  ACCIDENT  DATA  (TASK  ONE) 

5.2.1  CRITICAL  FLIGHT  PHASES 

The  data  shows  that  certain  phases  of  flight  produced  more  accidents  than 
others.  Sixty  percent  of  the  accidents  occurred  in  three  of  the  nine  phases 
of  flight  defined  for  the  study.  Takeoff  produced  21  percent  of  the  acci¬ 
dents,  while  final  approach  contributed  23  percent  and  landing  contributed  16 
percent. 

5.2.1 .1  TAKEOFF,  FINAL  APPROACH,  LANDING  PHASES 

The  data  showed  that  during  takeoff  mechanical  causal  factors  were  reported 
more  frequently  than  crew  errors.  Maximum  performance  is  required  of  the  air¬ 
plane  during  takeoff,  while  the  pilot's  task  is  to  monitor  the  performance  of 
the  airplane  and  to  guide  it  into  the  air.  During  this  phase,  the  most 
critical  pilot  task  is  to  decide  to  take  off  or  to  abort  the  takeoff.  The 
decision  is  based  on  the  performance  of  the  airplane  relative  to  the  runway 
and  weather  parameters.  The  crew  utilizes  all  available  information  to  make 
the  decision  including  out-the-window,  cockpit  instrument,  and  operation 
manuals  as  well  as  pilot  training  and  experience. 

The  accident  data  also  showed  that  final  approach  and  landinq  were  critical 
phases  of  flight.  During  these  two  phases,  crew  errors  were  cited  more 
frequently  than  mechanical  failures,  with  a  ratio  of  55  to  4  in  final  approach 
and  36  to  8  in  landing.  In  these  two  phases  of  flight  only  12  mechanical 
causal  factors  were  reported,  however,  the  number  of  crew  errors  in  navigating 
and  controlling  the  airplane  to  a  safe  landing  on  the  runway  showed  them  to  be 
critical  phases  for  the  flight  crew. 
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52A2  EFFECT  OF  CRITICAL  FLIGHT  PHASES  ON  CREW  PERFORMANCE 


During  takeoff,  final  approach,  and  landing,  the  aircraft  is  exposed  to  the 
hazard  of  an  inadvertent  collision  with  the  qround.  In  these  flight  phases, 
the  crew  experiences  the  greatest  workload,  activity,  and  opportunity  for 
unreconcilable  errors.  Crew  error  was  found  to  be  the  principal  cause  for 
accidents  in  the  final  approach  and  landing  phases,  and,  although  mechanical 
failures  were  more  numerous  than  crew  errors  in  accidents  during  takeoff,  the 
flight  crew  is  responsible  for  safe  recovery  from  those  mechanical  failures. 

In  other  phases  of  flight  relatively  few  accidents  occurred.  For  example, 
although  the  cruise  phase  of  flight  accounts  for  64  percent  of  the  operational 
time  of  a  typical  flight,  it  accounted  for  only  6.1  percent  of  the  accidents 
(Ref.  6).  Climb-out  and  descent  also  accounted  for  relatively  few  accidents, 
but  they  contain  the  transition  events  leading  into  and  out  of  cruise  and 
require  considerable  crew  activity. 

522  MULTIPLE  FACTOR  ACCIOENTS 

The  data  indicates  that  most  of  the  accidents  were  not  the  result  of  a  sinqle 

failure,  deviation,  mistake,  or  misjudgment;  they  were  the  result  of  accumu¬ 

lating  or  compounding  problems.  They  were  shown  to  be  the  result  of  multiple 
causes,  primary  and  contributing. 

Over  73  percent  of  the  accidents  examined  indicated  multiple  causes  for  the 
accident.  Twenty-seven  percent  of  the  accidents  were  the  result  of  a  sinqle 
causal  factor,  40  percent  were  the  result  of  2  causal  factors,  and  23  percent 
were  the  result  of  3  causal  factors. 

The  NTSB  data  base  from  the  160  accidents  reviewed  contained  177  cockpit  crew 

errors  along  with  87  mechanical,  49  weather,  10  operational,  and  20  "other" 
causal  factors.  Since  only  21  of  the  accidents  were  the  result  of  a  single 
cockpit  crew  error,  it  is  apparent  that  the  majority  of  crew  errors  were 


committed  in  conjunction  with  other  factors,  including  other  crew  factors. 

Many  of  the  crew  errors  were  the  result  of  improper  responses  to  situations 
precipitated  by  other  causal  factors.  In  such  cases,  instead  of  the  crew 
providing  a  recovery  from  the  situation,  they  often  aggravated  it. 

5.2.3  ANALYSIS  OF  CREW  ERRORS 

Considering  both  primary  and  contributing  causal  factors,  crew  errors  out¬ 
numbered  mechanical  failures  by  177  to  87,  or  over  2  to  1.  When  only  hull- 
loss  accidents,  which  generally  occurred  in  the  critical  flight  phases,  were 
considered,  errors  attributed  to  the  crew  outnumbered  mechanical  failures  by 
132  to  24,  or  5.5  to  1.  This  difference  supports  a  suggestion  that  high  crew 
activity  and  increased  workload  provide  an  environment  conducive  to  crew 
errors. 

5 .2 .3.1  CREW  ERRORS  AS  THE  PRIMARY  CAUSE 

The  analysis  of  the  160  NT SB  accidents/incidents  showed  that  in  21  accidents, 
crew  error  was  the  primary  cause  and  no  other  cause  was  reported.  The  most 
frequently  reported  crew  errors  were: 

o  Misjudged  speed,  distance,  altitude,  clearance,  etc.  (29%) 

o  Navigation  error  (19%) 

o  Failed  to  follow  approved  procedures  (14%). 

This  set  of  accidents  consists  of  only  hull-loss  accidents  and  was  discussed 
in  a  previous  section.  No  further  breakdown  of  the  accident  causal  factors 
was  made;  recourse  to  the  NTSB  accident  histories  could  possibly  reveal 
further  details  such  as  the  precise  navigation  error  made,  or  what  flight  para¬ 
meter  was  misjudqed.  The  causal  factor,  "FAILED  TO  FOLLOW  APPROVED  PROCE¬ 
DURES,  DIRECTIVES,  ETC.,"  is  somewhat  of  a  "catch-all"  selection.  An  earlier 
study  suggested  that  the  investigators  stopped  short  in  not  determining  why 
the  pilot  failed  to  follow  approved  procedures  in  a  particular  accident  in 
question  (Ref.  7). 
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523.2  CREW  ERRORS  AS  A  PRIMARY  CAUSE 

The  NTSB  data  showed  that  when  crew  error  was  listed  as  a  primary  cause,  150 
times,  the  errors  most  frequently  cited  were: 

o  Failed  to  follow  approved  procedures,  directives,  etc.  (21%) 

o  Misjudged  speed,  distance,  altitude,  clearance,  etc.  (14%) 

o  Selected  wrong  action/ took  no  action  when  one  was  required  (11%) 

o  Inadequate  supervision  by  the  pilot  in  command  (8%) 

o  Improper  application  of  controls,  brakes,  flaps,  etc.  (7%) 

o  Navigation  error  (6%) 

o  Instruction  (person-to-person)  -  Misunderstood/ambiguous/not 

received  (6%). 

Several  other  crew  errors  which  were  reported  less  frequently,  but  which 
warrant  attention  include: 

o  Attention  diverted  from  required  task  (7  times) 
o  Failed  to  use  proper  emergency  procedures  (3  times) 
o  Took  too  long  to  initiate  proper  action  (2  times). 


63 


523.3  HIGH  INCIDENCE  OF  SIMULTANEOUS/MULTIPLE  ALERTS 

Air  carrier  accidents  are  extremely  complex  events;  over  73  percent  of  the 
accidents  examined  reported  multiple  causes  for  the  accident.  The  data 
showed  that  when  alerting  devices  were  reported  to  have  been  activated, 
accidents  reported  to  be  caused  by  crew  error  had  over  twice  as  many  devices 
activated,  on  the  average,  than  when  the  primary  cause  was  mechanical  failure. 
It  indicates  that  the  crews  may  respond  without  error  when  only  a  few  alerting 
devices  were  activated,  but  may  make  errors  when  there  were  many  alerts  goinq 
off. 

Several  situations  can  cause  a  large  number  of  simultaneous  device  activations 
o  Multiple  failures 

o  Major  component  fail ure--coupled  sub-components  cease  to  function 

o  A  failure  annunciated  by  many  devices. 

Compounded  failures  or  a  confusing  barrage  of  horns,  lights,  and  bells  can 
create  the  high  activity  and  stressful  environment  that  can  cause  incorrect 
responses  and  failure  to  follow  correct  procedures. 

5.234  ANALYSIS  OF  FACTORS  OTHER  THAN  CREW  ERROR 

The  causal  factor  categories,  other  than  crew  error,  which  the  analysts  used 
were  weather,  mechanical,  operational,  and  other  (non-flight  phase  related). 

When  weather  was  a  primary  causal  factor  (sample  of  31),  factors  reported  most 
frequently  were: 
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o  Wind  (35%) 

o  Rain/Moisture  (19%) 

o  Thunderstorm/Tornado  (19%). 

When  mechanical  factor  was  a  primary  cause  (sample  of  64),  factors  reported 
most  frequently  were: 

o  Fire/ flame/smoke/explosion  (16%) 

o  Corrosion,  embrittlement,  fatigue  (16%) 

o  Tire  failure/wheel  failure  (14%) 

o  Power  plant  (cowling,  electrical  harness,  ducts,  etc.)  (11%). 

When  operational  factor  was  a  primary  cause  (sample  of  7),  factors  reported 
most  frequently  were: 

o  Aborted  takeoff  (29%) 

o  Ran  off  runway  (29%) 

o  Taxi  (29%). 

When  "other"  factor  (non-flight  phase  related)  was  a  primary  cause  (sample  of 
12),  factors  reported  most  frequently  were: 

o  Collision  (aircraft/bird/other  object)  (33%) 

o  Comnuni cations  with  ATC/Company  (25%) 
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Evasive  action  to  avoid  collision  (17%) 


o  Uncontrolled  attitude/altitude  deviations  (17%). 

While  the  above  are  the  causal  factors  most  frequently  reported,  less- 
frequently  reported  factors  involved  in  the  accidents  reviewed  included: 

o  Hail /sleet/freezing  rain  (5  times) 

o  Doors  (4  times) 

o  Flight  control  (2  times) 

o  Engine  -  partial  or  complete  loss  of  thrust  (1  time) 

5.3  CONCLUSIONS  FROM  FLIGHT  OBSERVATIONS  (TASK  TWO) 

Although  the  results  from  the  cockpit  observation  flights  were  not  supported 
by  large  statistical  bases,  they  provided  a  measure  of  supporting  data  for  the 
accident  data  analyses. 

53.1  UNTIMELY  ALERTS 

Current  caution  and  warning  systems  too  frequently  present  alerts  to  the  crew 
when  they  are  not  wanted.  Pilots  commented  on  getting  low-urgency  alerts 
during  certain  critical  flight  phases  and  getting  alerts  for  situations  which 
pose  no  threat. 

Several  crews  adhered  to  a  no-conversation  policy  below  certain  altitudes; 
this  included  an  instance  where  a  flight  engineer  refrained  from  calling  out  a 
minor  oil  temperature  deviation  during  takeoff  roll.  The  pilots  also  com¬ 
mented  on  getting  configuration  alerts  during  descent  when  the  power  was 
reduced  with  the  gear  not  down;  most  crews  manually  inhibited  the  aural  alert. 


Other  pilot  comments  were  related  to  nuisance  alerts.  The  most  prevalent 
nuisance  alerts  were  the  altitude  alert  and  the  terrain  avoidance  warninq  of 
the  GPWS.  On  the  flights  monitored,  the  altitude  alert  sound  was  activated  in 
nearly  every  descent  from  cruise  altitude  into  the  destination  terminal  air¬ 
space.  After  receiving  ATC  clearance  for  a  step-down  descent,  standard  cock¬ 
pit  procedure  is  to  set  the  new  required  interim  altitude  into  the  altitude- 
select  panel  and  arm  the  system.  The  problem  with  this  procedure  is  that, 
during  the  step-down  descent  phase,  new  altitude  clearances  are  not  always 
issued  by  ATC  in  time,  and  the  system  activates  the  alert  as  the  aircraft 
penetrates  the  set-in  altitude.  A  greater  problem  with  the  altitude  alert, 
not  mentioned  by  the  flight  crews,  is  that  the  system  has  two  functions  which 
conflict.  The  aural  Altitude  Deviation  Alert,  signalled  usually  by  a  single¬ 
stroke  chime,  can  be  degraded  by  the  frequent  use  of  the  same  signal  to 
annunciate  an  Altitude  Approach  Alert,  which  is  a  very  common  event.  The  use 
of  a  signal  to  annunciate  a  "reminder"  is  counter-productive  to  the  use  of 
that  same  signal  to  announce  an  abnormal  sitaution.  Changes  in  the  regula¬ 
tions  for  altitude  alerting  were  implemented  by  the  FAA  in  Amendment  91-14? 
dated  August  22,  1981. 

The  terrain  avoidance  alert,  a  synthetic  voice  presentation  from  GPWS,  was 
regarded  by  some  pilots  as  a  nuisance  because  of  its  distracting  sound  and 
intrusiveness  in  situations  where  they  felt  there  was  no  threat.  Two  flight 
operations  which  create  these  situations  are:  (1)  when  the  crew  descends  too 
fast  (knowingly)  into  a  terminal  area  in  VMC  and,  (2)  when  the  terminal 
approach  controller  vectors  the  aircraft  over  mountainous  terrain.  The 
former,  creates  a  nuisance  alert  because  the  crew  intentionally  created  the 
situation.  The  second  is  also  a  nuisance,  especially  if  the  crew  is  confident 
of  the  controller  in  IMC,  or  if  conditions  are  visual.  It  must  be  pointed  out 
that  the  GPWS  operated  as  it  was  designed  in  these  situations. 
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5.3.2  LOW  INCIDENCE  OF  ALERTS 


Discounting  the  nuisance  alerts,  there  were  no  alerts  observed  in  the 
52  flights.  There  were  occasions  such  as  having  a  delay  in  gate  departure  due 
to  a  "doors"  light  indicating  an  unsecured  door,  but  no  inflight,  non-nuisance 
alerts  were  observed.  This  was  not  surprising,  however,  as  the  industry  has 
attained  excellent  low  failure  rates  through  good  aircraft,  design  and  mainten¬ 
ance  procedures.  The  majority  of  causal  factors  are  cited  at  a  rate  of  less 
than  once  a  year  (Ref.  7).  However,  continued  reduction  in  failures  could 
lead  to  a  reduction  in  accidents/incidents  since  each  failure  affords  the 
opportunity  for  error  in  response  to  the  failure. 

5.3 3  SCATTERED  ALERT  INDICATIONS 

The  crews  commented  on  the  fact  that  there  were  so  many  bells,  whistles,  and 
tones  in  the  cockpit,  that  it  takes  a  few  seconds  to  determine  what,  sound  was 
activated  and  what  system  is  associated  with  that  sound.  A  majority  of  the 
pilots  and  flight  engineers  stated  that,  upon  receipt  of  an  alert,  the 
relevant  alert  indicator  must  first  be  located  and  the  alert  message  under¬ 
stood  before  action  could  be  taken.  That  process  is  hampered  by  the  many 
different  locations  of  the  indicators  in  the  different  aircraft  types.  The 
pilots  felt  that  the  alert  indicators  should  be  placed  in  a  central  location 
to  avoid  searching  for  the  alert  message.  The  pilots  agreed  that  the  number 
of  tones  should  be  reduced  to  only  a  few,  and  that  those  few  should  be 
standard  throughout  different  types  of  aircraft.  They  felt  that  with  only  a 
few  alerting  tones  and  appropriate  alert  lights  on  a  central  panel,  the  crew 
would  be  better  equipped  to  handle  emergencies  in  a  much  smoother  and  quicker 
manner.  Late  aircraft  desiqns  have  provided  centrally  located  alert 
annunciator  panels. 
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5.3.4  MISCELLANEOUS  PILOT  COMMENTS 

Collision  avoidance  was -a  matter  of  concern  for  the  crews.  They  were 
expressly  concerned  during  departures  and  arrivals. 

The  flight  crews  commented  on  the  importance  and  criticality  of  qround  control 
in  the  terminal  area.  Many  of  the  pilots  were  critical  of  ground  controllers 
that  do  not  provide  sufficient  information  concerning  the  taxi-way  and  takeoff 
areas.  Frequent  obstructions  due  to  construction,  and  heavy  traffic  during 
peak  arrival  and  departure  hours  contribute  to  the  problem.  The  pilots 
expressed  concern  that  accidents  can  happen  as  easily  on  the  qround  as  in  the 
air.  Flight  crews  suggested  that  "ramp  control"  for  operations  at  hiqh 
density  terminals  be  initiated  to  relieve  some  of  the  congestion  and  confusion. 

Finally,  the  pilots  commented  on  the  problems  of  distractions.  Some  of  these 
comments  were  couched  in  comments  about  nuisance  alerts,  but  others  were  not. 
Distractions  need  to  be  defined  and  kept  in  perspective  and  context.  A  dis¬ 
traction  can  be  grossly  defined  as  something  which  detracts  from  something 
more  important.  Dependent  on  what  the  crewnember  is  doing,  some  event  can  be 
a  "distraction"  in  one  situation,  hut  be  a  necessary  intrusion  in  another. 

Such  is  the  case  with  the  GPWS  terrain  alert.  When  occurring  as  a  result  of  a 
situation  intentionally  induced  by  the  crew,  the  GPWS  alert  is  called  a 
distraction,  but  when  the  situation  is  unintentional  and  hazardous,  the  GPWS 
alert  is  a  welcomed  intrusion. 

Besides  comments  on  the  distracting  effects  of  nuisance  alerts,  other 
distractions  that  were  identified  included:  airplane  sub-system  noise 
infiltrating  the  flight  deck,  talking  to  the  passengers  on  the  publ ic-address 
system,  radio  and  personal  voice  transmissions,  and  shuffling  for  charts, 
approach  plates,  and  other  documents  in  the  cockpit. 
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6.0  IMPACT  OF  FINDINGS  ON  ALERTING  SYSTEM  DESIGN 


Aircraft  accident  rates  can  be  reduced  by  several  means,  including:  improving 
the  airways  system,  aircraft  desiqn.  Dilot  performance,  airline  policies  and 
procedures,  and  crew  alertinq.  Implications  from  previous  studies  suggest 
that  accident  rates  can  be  reduced  by  improvements  in  crew  alerting. 

These  studies  have  shown  that  current  fleet  aircraft  have  many  alerting 
devices  and  methods.  This  has  come  about  because  of  a  lack  of  industry 
standardi zaticn  and  hecause  crew  alertinq  has  not  been  designed  as  a  system 
with  defined  functional  requi rements .  These  shortcomings  can  be  corrected 
by  adhering  to  the  Alerting  System  Design  Guidelines  (Ref.  5).  It  also  appears 
feasible  that  the  alerting  system  described  in  the  Guidelines  can  be  expanded 
to  provide  fliqht  status  monitorinq.  Such  a  system  would  provide  crew 
alertinq  for  operational  abnormalities  as  well  as  aircraft  system  failures. 
Based  on  the  conclusions,  such  a  system  must  consider  additional  alerts,  and 
several  other  functional  requirements. 

6.1  NEED  TO  CONSIDER  FLIGHT  PHASE 

The  examination  of  accident  data  and  the  flight  deck  environment  showed  that 
60  percent  of  the  accidents  occurred  durii.g  takeoff,  final  approach,  ana 
landing.  These  critical  flight  phases  are  characterized  by  increased  crew 
activity  and  crew  coordination.  The  flight  crew  should  be  protected  from 
distractions  from  the  piloting  tasks  during  these  phases  of  flight.  The 
evaluation  of  the  need  for  response  to  an  alert  can  only  be  made  if  flight 
phase  is  taken  into  account.  It  follows  that  a  flight  status  monitor  requires 
flexibility  and  adaptability  to  accommodate  changing  operational  and  updating 
requi rements . 
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6.1.1  EACH  FLIGHT  PHASE  UNIQUE 


Each  flight  phase  has  one  basic  purpose;  for  instance  the  basic  purpose  of 
final  approach  is  to  fly  the  aircraft  according  to  a  specific  descent  profile 
until  the  decision  height  is  reached  and  then  to  make  the  transition  to 
outside  visual  references  for  landinq.  If  for  example,  a  multiple  failure 
involving  a  major  system  and  associated  subsystems  were  to  occur  at  this  time, 
excessive  demands  on  the  information  processing  capabilities  of  the  crew  could 
be  imposed  thereby  having  a  direct  impact  on  the  safety  of  the  fliqht. 

The  pilot's  capacity  to  cope  with  increasingly  complex  situations  and  sub¬ 
systems  will,  in  part,  depend  on  the  patterns  and  skills  that  he/she  has 
developed  over  years  of  flying.  When  situations  occur  that  require  actions 
outside  the  capacity  of  learned  patterns  and  skills,  pilot's  performance, 
unaided,  may  slow  markedly.  Some  emergencies  did  not  follow  pre-established 
scenarios  for  fault  diagnostics  and  corrections.  Also,  worst  case 
considered,  there  is  no  way  to  predict  how  the  stress  of  sudden  demands  of  a 
multiple  alert  may  affect  the  crew's  performance.  Some  emergencies  cannot  be 
handled  by  going  strictly  by  the  book.  The  available  information  may  be 
incomplete  and  misleading  for  the  situation,  thereby  affecting  the  pilot's 
mental  picture  of  aircraft  status. 

6.1.2  SAME  ALERT-DIFFERENT  EMPHASIS  BY  FLIGHT  PHASE 

The  response  to  an  alert  must  be  weighed  against  the  other  tasks  the  pilot 
has.  Some  of  the  more  critical  phases  of  fliqht  during  which  emergencies 
occur  may  leave  only  enough  time  for  an  immediate  reaction  by  the  pilot.  In 
some  situations,  a  pilot's  response  may  be  more  influenced  by  habit  pattern 
developed  through  training  and  experience  than  by  the  process  of  inductive  or 
deductive  reasoning.  In  any  case,  the  crew  must  consider  each  alert  in  the 
context  of  all  the  tasks  and  activities  going  on  at  that  time. 
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Oigital  processing  techniques  provide  the  opportunity  for  systems  designers 
to  incorporate  new  and  improved  functions  in  the  alerting  system  logic.  That 
software  logic  should  contain  provisions  for  fliqht  phase  adaptation  by  the 
aircraft  systems  and  consider  all  combinations  of  failures  and  external 
conditions. 

According  to  the  Alerting  System  Design  Guidelines  (Ref.  5),  the  criteria  for 
a  warning  and  caution  alerts  is  stated  as  follows: 

WARNING:  Emergency  operational  or  aircraft  system 

conditions  that  require  immediate 
corrective  or  compensatory  crew  action 

CAUTION:  Abnormal  operational  or  aircraft  system 

conditions  that  require  immediate  crew 
awareness  and  require  prompt  corrective  or 
compensatory  crew  action 

Engine  fire  is  always  assigned  the  urgency  level  of  warninq,  however  the 
sophistication  and  reliability  of  aircraft  and  engines  today  have  changed 
crew  procedures  for  engine  fire  during  takeoff.  A  fire  warning  beyond  a 
reference  speed  is  left  unattended  until  the  aircraft  is  safely  airborne,  a 
positive  rate  of  climb  is  established  and  the  gear  retracted.  Those  objec¬ 
tives  are  met  before  the  crew  takes  corrective  action  on  the  engine  fire. 

This  procedure  is  quite  valid  when  considering  the  following: 

1.  The  fire  warning  may  be  false  and  shutting  down  the  engine  unnecessarily 
introduces  marginal  climb  performance. 

2.  An  enqine  on  fire,  may  for  a  limited  period  of  time  develop  some  thrust, 
thi.3  making  the  initial  climb-out  flight  phase  less  critical. 

3.  During  the  highly  critical  takeoff  phase  the  pilot  should  not  be  dis¬ 
tracted  by  actions  not  relevant  to  achieving  sufficient  obstacle 
clearance. 
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The  time  delay  in  closing  the  fuel  valves  and  activating  the  fire  agent 
bottle  will  usually  be  in  the  order  of  seconds,  not  minutes.  The  engine 
fires  today  are  not  as  detrimental  to  the  structural  integrity  of  the 
airplane  as  they  used  to  be. 

There  can  be  little  argument  that  engine  fire  constitutes  a  high-priority 
emergency  to  which  the  pilot  must  be  alerted.  We  have  therefore,  arrived  at  a 
paradox  that  on  one  hand  we  require  immedate  action  when  a  warning  alert  is 
activated,  but  on  the  other  hand  instruct  the  crew  to  disregard  the  warninq 
for  a  certain  period  of  time. 

Another  example  of  this  paradox  is  pitot  heat  failure.  During  low  altitude 
operations,  a  pitot  heat  failure  may  have  fatal  consequences  in  a  very  short 
time  because  freezing  moisture  can  plug  up  the  pitot  tube  causing  erroneous 
airspeed  indications.  However,  at  flight  level  350  and  an  indicated  outside 
air  temperature  of  thirty  degrees  below  freezing,  pitot  heat  failure  is 
relatively  harmless  and  requires  no  immediate  crew  action.  Another  example  is 
the  landing  gear  configuration  alert.  When  it  sounds  during  initial  descent 
from  cruise  altitude  it  is  just  a  nuisance  and  most  first  officers  observed 
automatically  silenced  it  with  a  cut-out  switch.  But  when  it  sounds  on  final 
approach,  it  does  indeed  warrant  immediate  crew  response. 

Summarizing,  it  becomes  clear  that  with  current  training,  the  pilot  is 
required  to  anlayze  all  alerts  irrespective  of  their  expressly-desiqned  signif¬ 
icance,  i.e.,  evaluate  their  urgency  relative  to  the  actual  ci rcumst.ances 
(flight-phase),  and  only  then  decide  on  what  action  to  take.  If  the  aircraft 
is  in  a  critical  flight  phase,  with  a  correspondingly  high  workload  in  the 
cockpit,  this  requirement  to  evaluate  all  alerts  can  lead  to  an  excessive 
workload  and  contribute  to  the  development  of  accidents/incidents.  The  use  of 
alert  prioritization,  adaptive  by  flight  phase,  should  ameliorate  this 
si tuation. 
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6.1.3  INHIBIT  LOW-PRIORITY  ALERTS  BY  FLIGHT  PHASE 


Low-urgency  alerts  can  disrupt  and  confuse  crew  activity  during  critical 
flight  phases.  Unnecessary  alerts  distract  the  crew  and  may  cause  them  to 
miss  more  vital  alerts  or  make  errors  in  critical  flying  tasks  while  searching 
for  their  solution.  Early  studies  showed  that  pilots  felt  there  was  a 
potential  for  too  many  alerts  in  critical  operating  regimes,  and  suggested  an 
inhibit  scheme  for  the  takeoff  and  initial  climb  phases  of  flight  (Ref.  3). 
Each  alert  should  be  tested  for  its  significance  relative  to  the  flight  task. 
Any  alert  which  fails  the  test  should  have  the  most  distracting  of  the 
alerting  components  inhibited  during  that  flight  phase. 

6.2  NEED  TO  DEAL  WITH  MULTIPLE  CAUSES 

The  data  base  showed  that  in  73%  of  the  accidents/incidents  surveyed  there 
were  multiple  causes.  It  is  expected  that  there  will  be  multiple  system 
abnormalities  even  when  precipitated  by  a  single  system  or  crew  failure.  In 
addition,  there  can  be  failures  precipitated  by  multiple  and  unrelated  fail¬ 
ures  over  a  short  period  of  time.  When  these  alerts  are  presented  to  the  crew 
in  the  form  of  multiple  and  simultaneous  alarms,  the  crew  can  be  immediately 
overloaded.  On  the  other  hand,  it  appears  feasible  to  provide  a  digital 
computer  with  the  proper  logic  to  quickly  and  reliablv  determine  the  relative 
criticality  of  the  alerts  and  display  them  to  the  crew  for  their  response.  Of 
course  the  required  logic  must  be  developed,  analyzed  and  subjected  to 
exhaustive  testing  to  insure  complete  and  reliable  coverage  of  the  failures 
and  the  recovery  process  and  to  determine  if  the  improvements  are  consistent 
with  predictions. 

6.2.1  ALERT  PRIORITIZATION  AND  INHIBITION 

Alert  prioritization  and  inhibition  can  help  the  pilot  respond  t.o  multiple 
alerts.  For  alert,  prioritization,  the  alerts  in  each  urgency  level  should  be 
automatically  prioritized  by  the  system  so  that  when  a  particular  fault 
occurs,  the  message  would  appear  on  the  display  in  its  appropriate  position 
relative  to  the  other  messages  of  the  same  category  already  present.  With 
this  approach,  the  most  important  message  would  always  be  at  the  top  of  the 
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displayed  alerts  in  its  category,  regardless  of  time  of  occurrence.  The 
application  of  alert  inhibit  logic  would  inhibit  low-urgency  alerts  during 
high  workload  flight  segments. 

In  an  earlier  phase  of  the  present  study,  it  was  determined  that  an  effective 
prioritization  system  would  have  to  be  flight  phase  adaptive.  Another  finding 
from  the  study  was  the  high  degree  of  variability  with  which  the  subject 
pilots  prioritized  a  given  set  of  alerts.  The  variability  was  not  surprising, 
considering  that  the  21  pilots  came  from  a  variety  of  organizations  and 
aircraft  types.  Two  issues  became  apparent.  First,  if  prioritization  and 
inhibit  logic  are  utilized,  they  will  probably  be  aircraft  and  airline 
specific.  Secondly,  the  development  of  the  actual  prioritization  order  will 
need  to  be  carried  out  by  design  engineers  as  well  as  pilots.  A  combination 
of  flight  experience,  aircraft  familiarity,  and  design  expertise  will  yield  a 
more  effective  prioritization  system  than  any  one  of  these  capabilities  would 
yield  by  itself. 

A  flight  simulation  study  performed  during  the  same  period  showed  the 
efficacy  and  need  for  prioritization  and  inhibits.  The  simulation  supported 
the  following  conclusions: 

1.  In  multiple  failure  situations,  pilot  performance  improved  significantly 
when  alert  prioritization  was  employed. 

2.  When  alerts  were  not  prioritized,  performance  was  significantly  better 
when  inhibit  logic  was  employed  to  delay  the  presentation  of  non- 
essential  information  on  the  display  (Ref.  8). 

6 3  NEED  FOR  A  CHECKLIST  CAPABILITY 

This  study  showed  that  a  large  percentage  of  incidents  resulted  from  crew 
error  and  in  particular  from  taking  the  wrong  action  or  no  action. 

Emergencies  are  often  compounded  by  increased  crew  workload.  One  way  to 
reduce  workload  and  human  error  would  be  to  computerize  the  emergency  proce¬ 
dures  which  are  presently  incorporated  in  emergency  and  abnormal  procedures 
section  in  the  flight  manual  and/or  in  cockpit  cards.  For  some  alerts  the 
ability  to  manually  call  up  the  procedure  checklist  onto  a  CRT  display  might 
be  desireable,  while  in  other  cases,  automatic  presentation  of  the  checklist 
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might  be  more  appropriate.  Some  emergency  procedures  miqht  be  abbreviated 
with  automatic  reconfiguration  of  parts  of  the  subsystems.  All  of  these 
varying  degrees  of  computerization  may  be  used  to  reduce  the  problems  of  wrong 
or  no  action  by  the  crew. 

The  incorporation  of  this  checklist  capability  may  also  increase  the  number 
and  variety  of  emergencies  which  can  be  handled.  The  present  limitations  are 
in  the  number  of  procedures  which  can  be  committed  to  paper  and/or  memory  and 
reliably  and  quickly  recalled  in  the  air  during  an  emergency.  With  vastly 
improved  memory  and  access  capability  available  in  advanced  data  handlinq 
systems,  the  number  of  catalogued  emergency  procedures  might  be  increased,  the 
limitation  being  the  engineering  man-hours  necessary  to  design,  analyze,  test, 
and  validate  the  procedures. 

64  NEED  FOR  ADDITIONAL  ALERTS 

The  examination  of  accident/incident  data  indicated  the  potential  benefit  of 
the  following  alerts. 

64.1  NAVIGATION  ERROR 

The  data  showed  that  when  crew  error  was  a  primary  cause,  approximately  6%  of 
the  errors  were  navigation  errors.  Navigation  error,  other  than  equipment 
failure,  can  be  of  such  varied  forms  that  a  general  treatment  is  not  produc¬ 
tive.  The  sensing  of  error  when  a  pilot  mi sinterprets  the  compass  heading, 
sets  in  the  wrong  VOR/ILS  station,  or  lands  on  the  wrong  parallel  runway  is 
unlikely.  However,  errors  due  to  equipment  malfunction,  failure  of  the  pilot 
to  follow  a  desired  course,  or  flight  into  hazardous  terrain  can  be  announced 
to  the  crew.  Also,  future  terrain  avoidance  systems  using  ground  based 
navigation  systems  should  have  an  interface  with  the  alerting  system. 
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64.2  WIND 


Wind  was  cited  as  a  factor  12  times  in  the  160  incidents  reviewed.  It  is 
unknown  how  many  involved  wind  shear.  Commercial  transport  aircraft  having 
inertial  sensors  require  relatively  little  effort  to  provide  wind  shear 
protection.  Non-inertially  equipped  aircraft  would  require  additional 
equipment/ sensors  to  provide  this  capability. 

6.42  TIRE/WHEEL  FAILURE 

Tire/wheel  failure  was  cited  10  times  in  the  160  accident  histories,  and  all 
of  them  occurred  during  the  takeoff  roll.  Low  tire  pressure,  leading  to 
eventual  tire  failure,  was  a  frequently  cited  condition.  The  failure  of  one 
tire  often  led  to  failure  of  adjacent  tires,  which  in  some  cases  resulted  in 
the  total  collapse  of  the  landing  gear,  a  wheel  well  fire,  and  the  severinq  of 
hydraulic  lines.  Detection  of  tire  under- inflation  or  failure  before  start  of 
takeoff  run  could  reduce  or  eliminate  this  accident  causal  factor. 

Some  of  the  most  tragic  accidents  associated  with  tire  failure  occurred  when 
the  aircraft  either  ran  off  the  runway  in  trying  to  abort  the  takeoff  or  was 
unable  to  gain  sufficient  speed  to  lift  off  with  adequate  clearance.  With  the 
availability  of  tire/wheel  sensors  and  computational  capability,  computerizing 
the  abort  decision  process  is  possible. 

644  COLLISION  AVOIDANCE 


There  were  only  a  small  number  of  collision  or  near  miss  incidents  in  the  data 
base;  however,  the  results  of  a  mid-air  collision  are  so  traumatic  that  colli¬ 
sion  alerts  and  collision  avoidance  occupy  a  strong  position  in  the  concept  of 
an  alerting  system.  There  have  been  dramatic  collisions  in  the  air  and  on  the 
ground:  the  San  Diego  mid-air  collision  and  the  Tenerife  collision  of  two 
747  aircraft  on  the  ground.  In  previous  phases  of  this  study,  a  time-critical 
display  function  was  identified  as  being  the  recommended  display  for  collision 
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avoidance.  Poorly  designed  systems  might  have  too  high  a  false  alarm  rate  to 
be  useable.  Therefore,  although  it  has  been  established  that  collision 
avoidance  systems  may  be  helpful  and  that  the  displays  proposed  are 
reasonable,  continued  study  is  needed  to  establish  the  traffic  collision 
avoidance  system. 

645  ABORTED  TAKEOFF 

Section  6.4.3  discussed  the  potential  reduction  of  accidents  in  aborted 
takeoffs  due  to  tire  and  wheel  failure.  However,  a  general  consideration  of 
aborted  t  ikeoff  should  include  all  other  failure  modes.  The  accident  data 
showed  that  engine  malfunction  was  the  most  common  cause  fo  aborted  takeoff. 
It  is  noted  that  tire/wheel  failure  resulted  in  more  serious  accidents  (hull 
loss  and  fatalities),  but  engine  malfunction  caused  more  incidents.  At  any 
rate,  aborted  takeoffs  was  a  causal  factor  in  a  significant  number  of 
incidents.  The  *>est  means  to  Dresent  the  alert  to  the  crew  (if  one  is  to  be 
presented)  has  not  been  established.  The  presentation  could  be  an 
alphanumeric  time-critical  alert,  "ABORT",  or  it  could  be  a  continual  graphic 
presentation  of  the  runway  remaining.  The  selection  of  the  continual 
presentation  would  afford  the  pilot  more  opportunity  to  monitor,  check  and 
make  an  appraisal  of  the  abort  criteria.  More  study  is  required  to  establish 
the  optimum  presentation  method. 
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7.0  ADDITIONAL  REQUIREMENTS  FOR  A  FLIGHT  MONITOR  APPLICATION 


7.1  GENERAL  REQUIREMENTS 

A  flight  status  monitor  should  include  the  functions  of  crew  alerting.  The 

following  display  components  were  recommended  in  "Aircraft  Alerting  System 

Design  Guidelines",  (Ref.  5): 

1.  Master  Aural  Alert  -  to  attract  the  crews  attention  and  provide  prelimi¬ 
nary  alert-urgency-level  information. 

2.  Master  Visual  Alert  -  to  attract  the  crew's  attention  and  provide  prelimi¬ 
nary  alert-urgency-level  information. 

3.  Visual  Information  Display  -  to  provide  a  location  where  all  warning, 
caution  and  advisory  messages  can  be  displayed. 

4.  Voice  Information  Annunciator  -  to  provide  voice  messages  when  rapid 
action  is  required  or  to  transfer  workload  from  the  visual  to  the 
auditory  channel. 

5.  Time-Critical  Warning  Display  -  to  provide  guidance  for  immediate  action 
necessary  for  flight  safety. 


In  the  practical  application  of  these  concepts  to  new  aircraft,  it  is  apparent 
that  although  all  aircraft  need  standardization  for  the  benefit  of  uniformity 
of  crew  training,  the  functions,  hardware  and  logic  may  be  different  for  dif¬ 
ferent  aircraft  and  airlines.  The  small  commuter  airliner  with  twin  turboprop 
engines  may  not  be  able  to  afford  the  weight,  cost  and  panel  space  for  dupli¬ 
cate,  dedicated  displays.  However,  large  commercial  aircraft  may  need,  and 
have  the  space  for,  duplicate  displays  with  a  number  of  sensors  and  sophis¬ 
ticated  interfaces  with  the  flight  management,  data  processing,  fault  monitor¬ 
ing  and  air  data  systems.  Yet,  both  of  these  aircraft  types  should  have  basic 
standardization  between  them;  that  is,  a  certain  tone,  light,  color  or  message 
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wording  should  have  the  same  meaning  to  the  crew  whether  in  the  commuter  air¬ 
craft  or  the  international  carrier.  Of  course,  even  for  these  displays,  the 
number  of  messages  and  the  logic  by  which  they  are  derived  will  be  different 
for  the  two  aircraft  because  of  the  different  engines,  system  equipment  and 
airline  procedures  involved. 

Multipurpose  displays  can  be  used  to  display  emergency  procedures  checklists 
to  provii  the  crew  with  guidance  on  the  appropriate  corrective  action. 

The  visual  information  display  would,  in  most  applications,  be  an  element  ad¬ 
dressable  display  such  as  a  cathode  ray  tube  or  a  flat  panel  display. 

However,  for  the  smaller  aircraft,  the  lighted  label  or  switch  panel  display, 
presently  widely  used,  would  probably  be  utilized  and  therefore  should  be 
designed  in  accordance  with  the  standardization  of  message  format  and  color 
usage  recormiended  in  the  Guidelines. 

To  summarize  the  application  considerations: 

1.  All  next-generation  commercial  aircraft  should  have  master  visual  alerts, 
master  aural  alerts,  a  visual  information  display,  a  voice  information 
display,  and  a  time-critical  warning  display. 

2.  The  master  visual  alerts,  master  aural  alerts,  and  time-critical  warning 
display  should  be  standarized,  but  tailored  specifically  for  each 
aircraft  design  as  discussed  in  the  Guidelines. 

3.  The  visual  information  display  vnll  vary  in  size  and  mechanization  to 
accommodate  various  aircraft  capabilities.  However,  the  messages  should 
be  standardized,  and  the  location  in  the  aircraft  should  be  as 
recommended  in  the  Guidelines. 
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4.  The  voice  information  annunciator  should  be  implemented  according  to  the 
Guidelines. 

5.  A  display  for  emergency  procedures  and  checklists  is  recommended.  It 
must  interface  with  the  control  and  display  functions  in  the  aircraft. 

6.  The  logic,  algorithms,  and  amount  of  interface  with  other  onboard  systems 
will  vary  with  each  aircraft  type  and  airline  user,  however,  much  will  be 
similar.  Packaged  alerting  and  warning  systems  may  be  practical  for 
smaller  aircraft.  For  the  large,  more  sophisticated  aircraft  the 
alerting  system  should  be  custom  designed  and  integrated  with  the  flight 
management,  data  handling  and  fault  monitoring  systems. 

7.1.1  INTERFACING 

Beyond  minimum  requirements,  there  is  a  place  for  increased  sophistication  and 
improved  capabilities  that  would  yield  benefits  both  desirable  and  feasible 
for  advanced  alerting  systems.  These  benefits  would  come  largely  by 
integrating  the  alerting  system  with  the  other  data  handling  systems.  It  is 
projected  that  for  future  airliners  there  will  be  an  integration  of  flight 
management,  performance  management,  flight  control,  fault  monitorinq, 
maintenance  data  recording,  sensor  subsystems,  navigation  and  communications. 
This  does  not  necessarily  mean  the  use  of  central  computers;  digital  data 
buses  could  enable  easy  interchange  of  information  between  subsystems.  The 
alerting  system  could  thereby  have  access  to  all  information  and  could  through 
the  use  of  sophisticated  logic,  assign  priorities,  inhibit  alerts,  and  even 
initiate  corrective  action.  The  definition  of  this  logic  and  algorithms  is 
beyond  the  scope  of  this  study,  however,  the  handling  of  emergency  situations 
by  automatic  reconfiguration,  and  automatic  selection  of  the  options  for  human 
consideration  will  expand  rapidly  as  the  technology  of  data  system  hardware 
and  software  matures.  For  the  present,  the  elements  of  the  alerting  system 
should  be  defined  to  the  extent  that  they  can  be  mechanized  to  provide  a 
standardized  form  and  function.  Industry  can  then  custom-design  the  logic  and 


81 


interfaces  to  the  extent  that  the  state-of-the-art  and  cost  effectiveness 
factors  warrant.  It  seems  that  the  amount  of  logic  involved  will  vary  a  great 
deal  from  the  sophisticated  data  systems  of  the  large  aircraft  to  the  simple 
and  perhaps  off-the-shelf  versions  incorporating  not  much  more  logic  than 
present  systems.  However,  in  all  cases  the  messages,  colors,  and  tones  should 
me  n  the  same  thing  to  all  pilots.  Finally,  as  with  all  integration  concepts, 
feasibility  must  be  established  for  a  particular  design. 

7.1.2  INFORMATION  PROCESSING 

From  the  foreqoing  it  is  apparent  that  the  information  processing  requirement 
will  vary  over  a  large  range,  but  that  in  the  most  capable  configurations  the 
information  processing  function  will  comprise  a  large  part  of  the  alerting 
system.  The  processing  will  include  the  logic  which  prioritizes  messages, 
inhibits  messages,  decides  which  checklist  is  required,  integrates  checklists 
for  multiple  faults,  assesses  sensor  data  for  system  status,  and  controls  the 
data  displayed.  The  capability  of  the  alerting  system  will,  in  all 
probability,  grow  with  the  capability  of  digital  technology.  This  growth,  in 
turn,  will  be  mainly  dependent  on  the  capability  of  engineers  to  economically 
design  reliable  software.  For  austere  systems,  the  information  processing 
technology  is  available  today;  the  major  design  effort  and  system  expense  will 
be  in  the  area  of  displays. 

As  stated  previously,  the  crew  interface  requirement  will  cover  a  wide  range 
of  complexities.  For  an  austere  s:  low  the  master  visual  and  master  aural 
alerts  will  usually  be  reset  manually;  a  button  on  the  visual  alert  will 
suffice  for  both  visual  and  aural  master  reset.  The  visual  information  dis¬ 
play  will  require  controls  for  line  address,  store/recall,  and  checklist 
functions.  These  functions  could  be  activated  by  buttons  located  along  the 
side  of  the  panel  and  aligned  with  the  messages,  or  by  other  methods  such  as 
voice,  keyboard,  or  a  touch-panel  on  the  display  face. 

For  the  sophisticated  systems  of  the  future,  store/recall  of  alert  messages 
and  the  display  control  functions  will  be  based  on  extensive  interrelation¬ 
ships  with  emergency  procedure  actions  and  integrated  with  other  aircraft 
system  controls. 
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7.2.1  FLIGHT  PHASE  EDITING 

The  incorporation  of  flight  phase  knowledge  (taxi,  takeoff,  climb,  etc.)  into 
the  logic  can  be  used  to  prioritize,  inhibit  and  modify  alert  messages.  For 
example,  the  alert  annunciating  a  single  generator  failure  or  a  pressuri zation 
failure  should  be  inhibited  during  takeoff  to  avoid  distracting  the  pilot  and 
possibly  causing  an  aborted  takeoff.  Some  of  this  is  done  on  present  aircraft 
but  more  sophisticated  logic  is  to  be  expected  as  the  technology  improves. 

The  investigation  of  the  logic  and  algorithms  for  flight  phase  editing  offers 
larqe  benefits  in  terms  of  reducinq  the  number  of  false  alarms,  pilot 
workload,  distractions,  and  confusion  with  more  important  alerts. 

7 22  PRIORITIZATION  FOR  MULTIPLE  FAILURES 

A  prioritization  scheme  should  be  incorporated  in  the  alerting  system  as  noted 
in  the  Guidelines.  As  a  minimum,  alerts  should  be  prioritized  by  urgency  level 
(warning,  caution  or  advisory).  The  logic  required  for  some  of  this 
prioritization  seems  apparent,  however,  an  in-depth  analysis  is  usually 
required.  The  derivation  of  the  logic  is  beyond  the  scope  of  this  study.  Each 
situation  must  be  examined  in  detail  for  each  aircraft,  even  to  the  extent  of 
adding  sensors  or  changinq  sensor  locations  so  that  the  logic  will  be 
error- free. 

7.2.3  CHECKLISTS 

After  the  pilot  gets  the  master  alert  and  reads  the  messaqe  on  the  visual 
information  display,  it  is  often  necessary  to  take  action  to  resolve  the  prob¬ 
lem.  At  the  present  time  this  action  is  either  performed  by  memory  or  by  re¬ 
ferring  to  an  emergency  procedure  manual  or  checklist  card.  In  the  aircraft 
of  the  future  with  its  digital  data  systems  and  multipurpose  displays,  a 
checklist  could  be  displayed,  thus  saving  precious  time  in  initiating  a 
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required  procedure  and  also  greatly  reducing  the  possibility  of  human  error. 
Also,  different  stages  of  a  complicated  procedure  could  be  shown  in  detail 
with  immediate  feedback  to  assure  that  the  correct  result  has  been  attained 
before  proceeding  to  the  next  step.  However,  the  logic  for  presentation  of 
the  alerts  and  the  procedural  checklists  must  be  carefully  conceived,  analyzed 
and  tested  for  each  particular  aircraft  type.  To  achieve  maximum  results,  ad¬ 
ditional  or  specialized  sensors  may  be  required;  but  the  benefits  should  be 
worth  the  development  costs  if  a  significant  number  of  aircraft  are  involved. 
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8.0  IMPLEMENTATION  CONSIDERATIONS 

8.1  INFORMATION  PROCESSING 

8.1.1  ALGORITHMS 

The  logic  which  initiates  the  alert  messages  can  be  simple;  often,  however,  it 
is  not  simple  and,  due  to  interaction  between  systems,  is  subject  to  errors. 

It  is  felt  that  algorithms  will  gradually  develop  in  pace  with  the  development 
of  software  techniques.  In  any  case,  the  algorithms  for  processing  alert 
information  must  be  conceived  and  developed  by  engineers  intimately  familiar 
with  the  systems  involved.  The  best  results  will  be  obtained  when  the 
operating  systems,  fault  monitoring  system  and  alertinq  system  are  developed 
together.  This  does  not  preclude  off-the-shelf  systems  for  some  of  the  more 
simple  applications;  however,  the  more  sophisticated  airliner  with  the  most 
complete  and  capable  alerting  systems  will  need  customized  logic  with  sensors, 
fault  monitoring  and  other  digital  systems  desiqned  with  optimum  alert 
processing  in  mind. 

As  digital  technology  continues  to  evolve,  new  computer  techniques  could  be 
used  to  generate  an  alert  from  a  set  of  conditional  stimuli,  none  of  which 
explicitly  relates  to  the  alerting  situation  (Ref.  9).  Current  technology  can 
find  rapid  solutions  involving  many  fixed  and  variable  parameters.  An  example 
of  such  an  approach  would  be  for  an  ABORT  TAKEOFF  alert.  Assume  that  the 
takeoff  should  be  aborted  if  the  engines  don't  attain/sustain  a  calculated 
thrust  level,  or  failures  occur  in  certain  subsystems,  or  a  tire  is  blown, 
etc..  Calculation  of  the  thrust  level  required  for  takeoff  involves  knowledge 
of  altitude,  temperature,  length  of  runway,  obstructions,  wind  direction,  wind 
velocity  and  aircraft  weight.  As  the  aircraft  proceeds  down  the  runway  the 
go/no-go  decision  could  also  be  influenced  by  the  actual  airspeed  achieved  and 
runway  remaining  in  addition  to  the  factors  previously  considered.  To  design 
an  ABORT  TAKEOFF  alert,  a’ 1  this  data  (and  probably  much  more  when  the  design 
details  aro  explored)  must  be  made  available;  moreover,  calculations  must  be 
continually  made  to  determine  the  potential  for  success.  At  the  same  time, 
calculations  for  a  one-engine  out  case  should  also  be  performed  in  the  event 
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of  an  engine  failure.  Most  of  the  data  required  for  such  automation  is 
already  available  in  the  flight  management,  enqine  management,  and  air  data 
systems.  Runway  distance-to-go  counted  down  by  a  nosewheel  odometer,  blown 
tire  sensors  and  the  capability  to  detect  asynmetric  flaps/slats,  etc.,  are 
also  already  available  on  some  aircraft.  Although  the  complexity  and  the 
attendant  reliability  of  integrating  the  required  inputs  needs  to  be 
considered  in  a  practical  design,  it  is  a  relatively  easy  task  for  a  digital 
computer  to  continuously  monitor  the  takeoff  and  make  abort  decisions  quickly. 

8.12  MEMORY  SIZING 

Memory  size  may  not  be  an  important  factor  in  the  cost,  weight  or  volume  of 
future  alertinq  systems.  Eight  thousand  16-bit  words  of  memory  will  suffice 
for  the  austere  system  whereas  64K  words  should  be  more  than  enough  for  the 
largest  system,  taking  into  consideration  that  most  of  the  operational  and 
sensor  data  is  available  from  other  subsystems.  For  comparison,  an  L 101 1 
Flight  Management  System  utilizes  an  BK  memory  to  acccomplish  the  navigation 
and  performance  management  functions.  A  typical  memory  allocation  budget  for 
each  of  these  two  applications  would  be  as  follows: 


Austere  Maximum 


Messages 

1.6K 

4.RK 

Instructions 

1.0 

16.0 

Parameters 

.5 

4.0 

Scratch  Pad 

.5 

1.0 

Overhead 

1.0 

16.0 

Growth 

3.4 

22.2 

Total 

8K 

64K 

Memory  size,  even  for  the  maximum  system,  will  not  contribute  greatly  to  the 
hardware  weight  and  cost  when  compared  with  other  factors  associated  with  the 
development  of  digital  systems.  The  major  costs  are  in  the  software. 
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8.1.3  ARCHITECTURE 


For  the  austere  system,  the  hardware  could  he  quite  simple;  inputs  could  be 
discretes  from  external  switches  or  sensors  such  as  flaps  down,  flaps  half 
down,  low  voltage,  low  hydraulic  pressure,  etc.  These  inputs  could  usually  be 
the  same  signals  which  operate  the  fault  monitoring  lights  of  present-day 
aircraft.  Each  could  be  input  to  the  alerting  computer  on  separate  wires,  and 
continuously  scanned  to  set  flags  in  a  status  section  of  the  operational  pro¬ 
gram.  An  executive  routine  could  bring  these  status  bits  into  the  Random 
Access  Memory  (RAM)  scratch  pad  memory  one  byte  at  a  time  for  processing  and 
appropriate  action;  the  instruction  program  could  address  other  status  bytes 
into  RAM  as  required  for  the  logic  sequence.  For  austere  svstems  outputs 
could  be  sent  via  power  switching  transistors  to  an  annunciator  panel  for 
lighting  the  appropriate  message.  For  more  sophisticated  aircraft  where  the 
display  is  a  CRT,  the  alert  messages  would  be  output  to  the  display's  signal 
generator  in  the  appropriate  sequence. 

For  the  sophisticated  system  most  of  the  input  data  could  be  taken  from  a  digi¬ 
tal  data  bus  with  only  a  small  amount  of  discrete  or  analog  data  coming  in  on 
separate  wires.  All  inputs  could  be  paralleled  to  separate  computers  each  of 
which  would  continually  cross  check  the  other(s). 

The  software  could  be  organized  to  include  an  input  scanning  function  with  RAM 
storage,  a  logic  instruction  set,  and  self- test,  control  and  output  generating 
functions. 

The  details  concerning  hardware  and  software  architecture  are  beyond  the  scope 
of  this  study.  However,  it  is  envisioned  that  hardware  could  be  made  the  same 
for  most  types  of  aircraft;  the  software  would  step  up  in  complexity  as  the 
system  acquired  additional  sophistication.  If  a  decision-making  capability 
impacting  flight  safety  were  also  to  be  introduced  into  the  logic,  the  system 
reliability  requirements  would  probably  be  increased  considerably,  thus 
drastically  altering  both  the  hardware  and  software  architecture.  For  the 
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most  sophisticated  systems  which  could  automatically  reconfigure  aircraft 
systems  during  emergencies,  the  computers  would  probably  be  triple  or 
guadruply  redundant  with  both  self  test  and  majority  voting  incorporated  with 
an  appropriate  level  of  redundancy  extended  also  to  the  display  generators  and 
displays. 

8.2  PRIORITIZATION 

As  determined  in  earlier  phases  of  this  study,  prioritization  of  alerts  is 
desirable  because  the  amount  of  information  presented  to  the  crew  can  be 
reduced  considerably,  and  the  most  important  problems  presented  first.  Such 
logic  can  be  implemented  in  the  digital  hardware;  the  problem  is  mainly  in 
devising  the  software.  Software  design  requires  a  thorough  knowledge  of  the 
systems  involved  in  a  particular  aircraft,  as  well  as  a  clear  understanding  of 
airline  procedures  and  pilot  preferences  and  operating  habits.  A  set  of  logic 
devised  for  one  airline  may  not  be  acceptable  for  use  with  another  airline. 

As  with  present  systems,  the  aircraft  manufacturer  will  devise  the  loaic  in 
consultation  with  the  airlines,  then  make  minor  specific  changes  as  desired  by 
the  various  individual  customers.  As  mentioned  previously,  the  logic  must  be 
carefully  analyzed  to  consider  all  foreseeable  failure  modes  and  sequences, 
then  thoroughly  tested  to  verify  that  important  alerts  are  not  masked  or 
inhibited  in  previously  unforeseen  circumstances. 

8.3  SENSOR  DATA 

Most  of  the  sensors  that  would  be  required  for  a  fault  monitorinq  system  can 
already  be  found  on  today's  aircraft.  However,  additional  sensors  will 
probably  be  necessary  to  resolve  ambiguities  in  the  mere  capable  systems.  For 
example,  it  might  be  desirable  to  sense  the  extension  of  each  slat  element  on 
a  wing  separately. 

New  sensors  may  also  be  needed  to  mechanize  newly-identified  alerts  such  as 
navigation  error,  windshear,  tire  and  wheel  faults,  impending  collision  and 
takeoff  abort.  An  alert  for  navigation  error  could  be  derived  from  existing 
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sensors  but  may  require  new  alqoritbms  in  the  navigation  computer  to  detect 
deviation  from  desired  flight  path  or  proximity  to  terrain.  A  windshear  alert 
would  probably  not  require  new  sensors  but  would  utilize  new  algorithms  in  the 
flight  management  system.  Sensors  for  low  tire  pressure  do  exist  but  others 
are  needed  for  wheel  vibration.  CoHison  avoidance  sensors  are  now  being 
explored.  It  is  projected  that  a  useable  collision  avoidance  sensor  and 
standardized  maneuver  algorithms  will  be  available  within  the  next  five  years. 
An  alert  for  takeoff  abort  would  require  a  runway  position  sensor  (available), 
and  a  comprehensive  interface  with  the  aircraft,  as  well  as  a  powerful 
processing  capability  and  complex  set  of  algorithms. 

In  summary,  except  for  collision  avoidance,  development  of  an  alerting  system 
capable  of  flight  status  monitoring  is  not  dependent  upon  new  sensor 
technology. 

84  CONTROLS  AND  DISPLAYS 

The  technology  is  currently  available  to  implement  the  control  and  display 
functions  of  a  flight  monitor  system.  For  the  near  term,  some  aircraft  can 
afford  the  space,  weight  and  cost  of  CRTs,  whereas  other  aircraft  might  be 
constrained  because  of  these  factors.  However,  as  flat  panel  display 
technology  advances,  the  availability  and  cost  of  these  displays  will  come 
within  reach  of  the  smaller  aircraft.  For  the  next  generation  aircraft 
(beyond  the  Boeing  757/767)  display  technology  will  not  constrain  the  alerting 
system  design;  displays  wiil  be  available  at  reasonable  cost  to  display  any 
format,  in  any  color,  and  in  any  time  sequence.  Of  course,  cockpit  panel 
space  will  always  be  at  a  premium,  but  the  use  of  multipurpose  displays  with 
programmable  controls  for  other  display  requirements  will  release  sufficient 
panel  space  for  alerting  system  requirements. 

The  controls  pertaining  exclusively  to  the  alerting  and  warninq  system  are  not 
extensive;  however,  the  controls  associated  with  the  emergency  procedures, 
envisioned  as  beinq  integrated  into  the  system,  could  be  extensivr.  These 
latter  controls  might  be  the  same  controls  normally  utilized  for  operating  the 
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various  aircraft  systems.  For  this  reason,  they  must  be  closely  integrated 
with  other  system  controls  and  associated  logic.  The  implementation  of 
controls  therefore  must  be  approached  from  an  integrated  system  design 
point-of-view. 

The  use  of  voice  alerts  and  messages  is  described  in  the  Guidelines  (Ref.  5). 
The  hardware  for  this  purpose  is  well  along  in  development  and  should  be  able 
to  provide  the  desired  capability  at  a  reasonable  cost  -  near  term  for  large 
aircraft  and  far  term  for  the  smaller  aircraft. 

Although  the  hardware  doesn't  pose  a  major  problem,  the  design  of  messages, 
formats,  logic,  algorithms  and  software,  as  usual,  will  require  the  major 
effort.  Software  will  vary  in  complexity  from  very  simple  for  the  austere 
airplane  to  quite  complex  for  the  other  aircraft  which  may  require  the 
capability  of  extensive  automatic  emergency  procedures  and  require 
considerable  system  redundancy. 

8.5  INTERFACING 

Eventually,  even  the  most  austere  alerting  system  will  be  driven  by  a  digital 
computer,  thus  the  interfacing  problem  will  he  that  of  inputs  to  a  digital 
computer.  The  more  capable  and  advanced  systems  will  have  diqital  bus  systems 
on  which  all  sensor  data  will  be  multiplexed  and  available  for  all 
computational  functions,  including  crew  alerting.  Interfacing  in  these  cases 
will  primarily  involve  software.  In  interim  systems,  which  do  not  utilize 
general  purpose  data  buses,  the  interfacing  will  be  best  handled  by  dedicated 
analog-to-digital  converters  sampling  the  sensor  outputs  at  some  medium  rate, 
e.g,,  30  samples  per  second.  These  A-D  converters  can  be  in  an  alerting 
computer  or,  in  the  larger  aircraft,  the  converters  may  be  remote  to  take 
advantage  of  the  multiplexing  to  reduce  wire  weight.  In  any  case  the 
interface  implementation  will  not  be  a  unique  problem;  there  will  be  many 
other  avionic  functions  requiring  the  same  type  of  interfacing. 
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9.0  RECOMMENDED  FUTURE  DIRECTIONS 


This  phase  of  the  study  has  established  the  feasibility  of  the  concept  of 
expanding  the  functions  of  the  alerting  system  to  perform  as  a  flight  status 
monitor.  Since  the  functional  requirements  to  provide  flight  status 
monitoring  significantly  add  to  the  requirements  of  the  alerting  system,  it  is 
necessary  to  take  a  systems  approach  to  defining  the  new  concept  of  a  Flight 
Status  Monitor. 

9.1  REFINE  EXPANDED  ALERTING  SYSTEM  CONCEPTS 

The  first  requirement  is  to  expand  the  point  of  view  from  the  concept  of  dis¬ 
playing  alerts  to  a  flight  crew  to  a  concept  of  providing  crew  alerting  to 
both  equipment  malfunctions  and  abnormal  operational  conditions.  As  noted  in 
the  study,  the  expansion  of  the  alerting  system  to  perform  a  flight  status 
monitor  function  would  require  additional  sensing,  computing  and  processing, 
interfacing,  and  controlling  and  displaying.  These  new  functional  require¬ 
ments  must  be  integrated  to  form  the  design  concept  for  a  Fliqht  Status 
Moni tor. 

9.2  DEMONSTRATE  FLIGHT  STATUS  MONITOR  CONCEPT 

The  functional  design  concept  for  a  Flight  Status  Monitor  must  be  demonstrated 
t.o  be  feasible  for  implementation  into  hardware  for  flight  deck  applications. 
To  accomplish  this  task  it  is  recommended  that  a  conceptual  design  be 
installed  in  a  laboratory  mock-up  or  a  flight  simulator  for  demonstration. 

The  design  need  not  be  a  full-up  system,  but  sufficient  to  permit  an 
evaluation  of  the  concept  and  to  support  a  decision  to  proceed  to  the  next 
phase  of  development. 

9.3  IMPLEMENTATION  INTO  HARDWARE 

Following  demonstration  of  feasiblity,  it  is  recommended  that  a  flightworthy 
system  be  fabricated  for  evaluation  in  an  operational  environment.  The  system 
should  be  sufficiently  engineered  to  permit  operation  in  a  flight  deck,  but 
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not  so  integrated  with  other  systems  on  the  flight  deck  that  removal  following 
evaluation  is  prohibitive.  This  task  requires  that  flight  quality  components 
be  utilized  in  the  design  and  that  all  interfaces  between  the  system  and  the 
host  vehicle  be  provided. 

94  EVALUATION  OF  THE  CONCEPT 

It  is  recommended  that  the  concept  system  be  evaluated  in  the  environment  in 
which  the  system  would  be  utilized.  However,  due  to  the  impact  of  certifica¬ 
tion  requirements  and/or  high  cost  of  an  evaluation  on  the  flight  deck  of  an 
aircraft,  it  is  recommended  that  the  evaluation  of  the  fliqht.  status  monitor 
be  conducted  in  vehicles  such  as  the  National  Aeronautics  and  Space 
Administration  (NASA)  Terminal  Configured  Vehicle  (TCV)  or  other  flight  test 
vehicle.  The  system  should  be  evaluated  sufficiently  to  permit  the 
establishment  of  minimum  operating  standards  for  the  equipment  and  basic 
operatinq  procedures  for  the  use  of  the  equipment. 
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appendix  a 

Accident/Incident  Survey 
Data  Collection  Form 


SPACES 

REQUIRED 


001-003 


ACCIDENT  CODE  NUMBER 


Boeing  100  to  399 
Douglas  400  to  699 
Lockheed  700  &  on 


004-009 

010-017 

018-033 

034-045 

046-057 

058-069 

070-073 


074- 

075-078 

079- 

080 

081 

082- 

083- 

084-085 

086- 

087- 

088-092 

093-057 


I  I  FLIGHT  PHASE  -  1-Takeoff.  2-lmtial  Climb,  3-Climb. 

4-Cruise.  5-Descent.  6-lmtial  Approach 
7-Final  Approach.  8-Landing.  9-Taxi  (In  or  Out) 


TIME  OF  DAY  -  Local  Standard  Time 


□ 

□ 

□ 

□ 

□ 


LIGHT  CONDITIONS  -  1-Day.  2-Night.  3-Dawn  or  Dusk 

AIRCRAFT  DAMAGE  -  1 -Destroyed  2-Substantial.  3-Minor.  4-None 

INJURIES  -  1 -Fatal.  2-Seriou,r..  3-Minor.  4-Nonc- 

NUMBER  OF  COCKPIT  CREW 

NUMBER  OF  OTHER  PERSONS  IN  COCKPIT 
9  NO  OTHER  PERSON 


NUMBER  FLIGHT  HOURS  IN  LAST  24  HRS  (CAPTAIN) 
(Add  "9  in  084  For  Estimate) 


□ 

□ 


PILOT  AT  CONTROLS  -  t  •''aptain,  2-First  Officer.  3-Shared  (Switched).  0-Unknown 
WEATHER  CONDITIONS  -  1-IMC,  2-VMC,  0-Unknown 


RUNWAY  VISUAL  RANGE  -  In  Feet  (0  in  088  if  unkn)  (9  in  088  in  unlimited) 


CEILING  (WHEN  PROBLEM  OCCURRED)  -  In  Feet 
(Add  “9"  in  093  For  Unlimited)  (0  in  093  if  Unknown) 


098-100 


VISIBILITY  RESTRICTIONS  -  Any  Three 
1-Fog.  2-Rain,  3-Dust,  4-Snow,  5-Haze,  6-Clouds 


A-l 


101 


102- 
103-107 
1 08 
109 

I  to¬ 

ll  1- 1 12 

113-115 

1  16- 

II  - 
1 18- 
1  19- 
120- 
121- 
122- 

123- 

124- 

125- 

126- 

127 

128 


WHAT  SYSTEM  FAILURES  OCCURED? 
HYDRAULIC 
FUEL 

ELECTRICAL 
ECS 

AVIONICS 
ICE  &  RAIN 
FIRE 

LANDING  GEAR  AND  BRAKES 
FLIGHT  CONTROLS 
ENGINES 

GROUND  PROXIMITY  SYSTEM 
OTHER 
NONE 


□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 

□ 


1  -Reported  &  Annunciated 

2- Probable  &  Annunciated 

3- Reported  &  Not  Annunciated 
0-Unknown 


A-2 


129 


□  WERE  ANY  ALERTS  INDICATED  IN  SPACES  116-128  FALSE  ALARMS? 
1-Yes,  2-No,  0-Unknown 

Uncoded  Statement  -  Describe  Specific  False  Alarm 


130-210 


21 1  - 


212- 


213-217 


80  Spaces  Reserved  For  Coding  Data  in  Table  I.  Listing  of  Alerting  Devices  That  Should  Have 
Been  Activated  For  Each  Failure  Listed  in  Spaces  116-128. 


I  I  WAS  THE  CORRECTIVE  ACTION  TAKEN  APPROPRIATE  FOR  THE  MALFUNCTION 
INDICATED  IN  SPACES  116-128’ 

1-Yes,  2-No,  3-Probable.  0-Unknown 


I  I  WAS  THE  CREW  PROVIDED  WITH  AN  INDICATION  OF  THE  CAUSAL  FACTORS? 
1-Yes,  2-No,  3-Probable,  0-Unknown 


IF  NO"  IN  SPACE  212,  WHAT  ADDITIONAL  INFORMATION/ALERTS 
SHOULD  HAVE  BEEN  PROVIDED?  (5  SPACES  RESERVED  FOR 
CODING)  PLACE  1  IN  SPACE  213  IF  TEXT  IS  PROVIDED. 

Noncoded  Text  -  Describe  Additional  Information. 
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□  WHO  PERFORMED  THE  CORRECTIVE  ACTION  FOR  FAILURES  LISTED  IN  SPACES 
116-128? 


1 - Pilot  Flying  (on  Controls) 

2- Pilot  Not  Flying 

3- Flight  Engineer  (2nd  Officer) 
0-Unknown/Not  Reported 


EZ]  HOW  MANY  CAUSAL  FACTORS  ARE  GIVEN  FOR  THIS  ACCIDENT? 


A- 3 


219 


CAUSAL  FACTORS 


Five  Causes  Can  be  Listed  -  6  Spaces  for  Each  List  in  Estimated  Order  of 
Contribution  to  the  Accident. 


220-225 

226-231 

232-237 

238-243 

244-249 


_  FIRST  SPACE  IN  EACH 

1 - Primary  Cause  (Can  be  More  Than  1) 

2- Contributing  Cause 

_  SECOND  SPACE  IN  EACH 

1 - Cause  Established  by  Investigation  Agency  -  Official  Cause 

2- Cause  Detemined  From  Available  Data  -  Judgement 

_  THIRD  SPACE  IN  EACH  MAJOR  CAUSE 

1 - Cockpit  Crew 

2- Weather 

3- Mechanical  (Airplane) 

4- Operational 

5- Other 

0-Unkn  or  awaiting  report 

_  LAST  3  SPACES  IN  EACH 

Determine  Detail  Factor  From  Following  Tabulations 


250- 

251- 

252- 

253- 

254- 


SOURCE  OF  DATA  IDENTIFY  ONE  OR  MORE 


□ 

□ 

□ 

□ 

□ 


NTSB/CAB 

FOREIGN  GOVERNMENT  REPORT 
ICAD 

IN-HOUSE  DATA 
ASRS 


1 - Primary  Source 

2- Supplementa!  Data 


A-4 


COCKPIT  CREW  FACTORS 


Judgement 

001  Misjudged  speed,  distance,  altitude,  clearance,  etc. 

002  Improper  application  of  controls,  brakes,  flaps,  etc. 

003  Attempted  operation  with  known  deficiencies 

004  Flight  into  known  bad  weather,  in  turbulence 

005  Took  too  lonq  to  initiate  proper  action 

006  Selected  wrong  action/took  no  action  when  one  was  required 

007  Selected  wronq  control  or  put  control  in  wrong  position 

Approval  Procedures  Not.  Followed 

Oil  Failed  to  follow  approved  procedures,  directives,  instructions, 
etc . 

01?  Failed  to  use  proper  emergency  procedures 
013  Mismanagement  of  fuel 

014  Failed  to  extend  gear /retracted  gear  too  soon 

015  Operated  aircraft  outside  of  specs  on  standard  configuration 

T rai ni nq/Experl ence/Superv i si  on 

021  Inadequate  supervision  by  pilot  in  command 

022  Inadequate  training  or  experience 

023  Flight  manual  -  deficiency/error/ambiguous 

Medical /Incapacitation/Physical  Impairment 

031  Hypoxia 
032  Alochol 

033  Physical  impairment  (e.g.,  heart  attack) 

034  Mental  impairment  (e.g.,  unconsciousness) 

035  Sense  impairment  (e.g.  sight,  hearing) 


A-5 


Conmuni  cations  -  Failure  of  Informative  Transfer 


041  Instruction  (person  to  person)  -  misunderstood/ambiguous/ 
not  received 

042  Environment  -  too  noisy/depressurization/disturbing 
043  Instructions  ignored  or  not  heard 
044  Language  difficulty 

045  Equipment  information  -  misinterpreted  (assume  output  correct) 

Planning  -  Improper/Faul ty/Inadequate,  etc. 

051  Improper  pre- flight  planning 
052  Navigational  error 
053  Fuel  mismanagement 
054  Weight  and  balance  error 

Visual  Impairment/Special  Disorientations 

061  Failed  to  see  or  avoid  other  aircraft  or  object 

062  Light  too  bright/too  dim/glared/reflections 

063  Line  of  sight  obstructed 

064  Color  coding  inadequate  or  misunderstood 

065  Shape  coding  inadequate  or  misunderstood 

066  Visual  signal  -  ignored  or  unseen 

067  Smoke,  haze,  visibility  impairment 

Workload  -  Too  High/Too  Low 

071  Extra  task  load  caused  errors  or  forgetfulness 

072  Complacency  errors  caused  by  too  little  task  requirements 

073  Confusion  caused  by  unclear  task  requirements 


Distraction/Disturbed  Mental  State/Recklessness/Irresponsibil ity 


081  Attention  diverted  from  required  task 

082  Distraction  from  extra  persons  in  cockpit 

083  Illusions  -  false  or  real 

084  Alcohol  or  drug  induced 

085  Distractions  from  smoke /fumes /odor 

086  Distractions  from  temperature  extremes 

087  Abnormal  behavior 

Mi scellaneous 

091 

092 

WEATHER  CAUSAL  FACTORS 

Select  the  weather  data  that  describes  the  causal  factors  of  the 
accident/incident 

101  Fog 

102  Rain/moisture 

103  Snow 

104  Hail/sleet/freezing  rain 

105  Wind 

106  Restricted  visibility  (fog,  dust,  haze,  etc.) 

107  Thunderstorm/tornado 

MECHANICAL  CAUSAL  FACTORS 


Indicate  which  system(s)  problems  were  considered  causal  factors 

201  Corrosion,  embrittlement,  fatigue 

202  System  operated  spontaneously  and  unexpectedly  (not  selected  or 

wanted) 

203  System  selected  by  did  not  operate  properly 
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204  Fluid  loss  or  lack  of 

205  False  warning  Indicated 

206  No  warning  Indication 

207  Engine  -  foreign  object  damage 

208  Engine  -  flame  out  or  case  penetration 

209  Engine  -  tear  away 

210  Engine  -  partial  or  complete  loss  of  thrust  other  than  7,  8,  or  9 

211  Fire/flame/smoke/explosion 

212  Cabin  depressurization 

213  Rapid  release  of  stored  energy  (O2  bottles,  accumulators,  not 

tires) 

214  Tire  failure/wheel  failure 

215  Air  conditioning 

216  Auto  flight 

217  Communication 

218  Electrical  power 

219  Fire  protection 

220  Flight  control 

221  Fuel  and  fuel  controls 

222  Hydraul 1 c  system 

223  Ice  and  rain  protection 

224  Indicating/ reporting  system 

225  Landl ng  gear 

226  Light 

227  Navigation 

228  Oxygen 

229  Pneumatic/environmental  control 

230  Water/waste 

231  Airborne  aux  power 

232  Structure 

233  Doors 

234  Fuselage 

235  Nacelles  and  pylons 

236  Stabilizers 

237  Windows 

238  Wings 


A-8 


r 


239  Power  plant  (cowling,  electrical  harness  ducts,  etc. 

240  Ignition  and  engine  starting 

241  Bleed  air 

242  Engine  controls 

243  Engine  oil 

244  Engine  exhaust 


A-9 


1 


OPERATIONAL  CAUSAL  FACTORS 

Phase  of  flight  related 

301  At  terminal  -  static 

302  Taxi  out 

303  Taxi  in  to  terminal 

Takeoff 

311  Tail  smoke/over  rotation 

312  Run  off  runway 

313  Engine  related 

314  Aborted  takeoff 

315  Tire  failure 

316  Wheel  and  brake 

Climb 

321  Fuel  dump 
Cruise 

331  Oxygen  mask  deployment  problem 

332  Pressure  loss  in  cabin 

333  Engine  thrust  loss 

Descent 

341  Emergency  descent 


i 
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Approach 


351  Landing  aids  failure 

352  Asynwetric  controls 

Landing  and  roll  out 

361  Landed  short 

362  Ran  off  runway 

363  Overweight  landing 

364  Landed  long  -  more  than  500’  from  threshold 

365  Gear  collapsed  or  was  not  down  and  locked 

366  Tire  or  wheel  damage 

367  Hard  landing 

368  Ditching 

OTHER/NON-FLIGHT  PHASE  RELATED 

471  Evasive  action  to  avoid  collision 

472  Any  other  abrupt  maneuver 

473  Collision  (aircraft/bird/ot.her  object) 

474  Uncontrolled  attitude/altitude  deviations 

475  Communication  (ATC,  company,  etc.) 


A- 1 1 


AIRCRAFT  ALERTING  SYSTEMS  STANDARDIZATION  STUDY 
COCKPIT  OBSERVATION  FORM 


NAME  OF  AIH  CARRIER 


NAME  OF  PILOT  IN  COMMAND 


NAME  OF  SECOND-IN-COMMAND  NAME  OF  F  LIGHT  ENGINEER 


DEPARTURE 


ESTIMATED 

TIME 

EN  ROUTE 


CREW  BASE  ICITY  &  ST  AT  E  i 


PRELIGHT 

WEATHER  ANALYSIS 


FLIGHT  PLANNING 


CREW  BRIEFING 


COCKPIT  DESIGN 


DISPATCH  ITEMS  (  )  NUMBER 


ALERTING  SYSTEM  CHECKOUT 


ALERTING  SYSTEM  DISCREPANCIES 


NUMBER  OF  VOICE  TRANSMISSIONS 


USE  OF  CHECKLISTS 


DEPARTURE 

STARTING  PROCEDURE 


USE  OF  CHECKLISTS 


ALERTING  SYSTEM  OPERATION/USAGE 


RUN  UP 


INSTRUCTIONS  ON 

EMERGENCY  PROCEDURES  (DYES  □  NO 


CLEARANCE 


V,.  VR.  AND  V2  CALLOUTS  OYES  □  NO 


TAKEOFF  autopilot 

OlFR  0  VFR  0  YES  0NO 


CLIMBOUT 


APPROACH  AND  LANDING 

AIRCRAFT  CONFIGURATION  CHANGES 


AIRSPEED  'POWER  CHANGES 


USE  OF  CHECKLISTS 


CREW  DUTIES 


APPROACH  CLEARANCE 


TYPE  OF  APPROACH  COUPLED 

0IFR  □  VFR  0  YES  0  NO 


NUMBER  OF  VOICE  TRANSMISSIONS 


CREW 

ACTIVITY  0HIGH  0  MED  0  LOW 


ALERTING  SYSTEM  OPERATION/ALERTS 


CREW  DUTIES 


AUTOLAND  0  YES  0  NO 


AUTOPILOT  ON  ( 

)  ALTITUDE 

CREW  DUTIES 

NUMBER  OF  VOICE  TRANSMISSIONS 


CREW 

ACTIVITY  0  HIGH  O  MED  O  LOW 


EN  ROUTE 


LEVEL  OFF 


USE  OF  CHECKLISTS 


ALTITUDE  ALERTING  SYSTEM  I  I  ALERTS 


USE  OF  NAVAID  FACILITIES/RADIO  TUNING 


NAVIGATION  PROCEDURES 


CREW  DUTIES 


CREW  ACTIVITY  OHIGH  0  MED  0  LOW 


ALERTING  SYSTEM  OPERATIONS/ AVERTS 


NUMBER  OF  VOICE  TRANSMISSIONS 


B-l 


ALERT  ANNUNCIATED 


ALTITUDE  OF  OCCURRENCE 


FLIGHT  PHASE 


DESCRIBE  SITUATION  AND  CREW  RESPONSE 


CORRECTIVE  ACTION  TAKEN 


POSTFUGHT  NARRATIVE 


COMMENTS/NOTES 


